14cf7648123e018dcdfc2aa386135a0510a9f7b12b8bc125ad4e32fd7f16999c | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 17:59

Sharing

Report Analysis Logs

General

Target

SolaraBootstrapper.exe
Size

13KB
MD5

8be476fb431fcf11156417f410acf978
SHA1

55a19def82358ffc006487e1f49be04277e12bd5
SHA256

14cf7648123e018dcdfc2aa386135a0510a9f7b12b8bc125ad4e32fd7f16999c
SHA512

cf747947ff0bedf87230e0fa08ee534f44f08962a52ae3dd0c0d734d6f4131456a0e2dc1ac230fa6500d5b254a64cae9e01161d1a690e26794c38d66e22cb5ed
SSDEEP

192:IUxOQrGVa/nHU0LgJ2jaVb4+LHdrDXy3pifUJ1hHxrWjd:hIQaVafU0LmqaVb4+xPy5ifU1hRyj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2900 1936 WerFault.exe SolaraBootstrapper.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SolaraBootstrapper.exe

description pid process

Token: SeDebugPrivilege 1936 SolaraBootstrapper.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SolaraBootstrapper.exe

description	pid	process	target process
PID 1936 wrote to memory of 2900	1936	SolaraBootstrapper.exe	WerFault.exe
PID 1936 wrote to memory of 2900	1936	SolaraBootstrapper.exe	WerFault.exe
PID 1936 wrote to memory of 2900	1936	SolaraBootstrapper.exe	WerFault.exe
PID 1936 wrote to memory of 2900	1936	SolaraBootstrapper.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1088
2⤵
- Program crash
PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x000000007494E000-0x000000007494F000-memory.dmp

Filesize
4KB

Download
memory/1936-1-0x0000000001150000-0x000000000115A000-memory.dmp

Filesize
40KB

Download
memory/1936-2-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-3-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download