1877215a26a26cf0ead4310b2af975a20470ef8cb5c6f17965ee18643ca2ac9a

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 15:10

Target

nox_setup_v7.0.6.0_full_intl.exe
Size

573.8MB
MD5

311ff91c7d6d97c75b8654121dea9871
SHA1

e01260a79cd9052da869fb5ae50384d1266ea83e
SHA256

1877215a26a26cf0ead4310b2af975a20470ef8cb5c6f17965ee18643ca2ac9a
SHA512

9568fc6b65726a6c60903d6799aa641f1684e990c5a191bc110f911dd2744bae5002f5c871effeeb22c49bc88460b430b5ed9b921bfc08e7ed5aa95bde0e8c28
SSDEEP

12582912:/c5549YAMw7iY7VF8Ub1DWyD9VWOA9MSiGU6Hd:/c557AyoPeyJVEf1d

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
2856	CheckGLVersion.exe

Loads dropped DLL 1 IoCs

pid	Process
1952	nox_setup_v7.0.6.0_full_intl.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2856	1952	nox_setup_v7.0.6.0_full_intl.exe	28
PID 1952 wrote to memory of 2856	1952	nox_setup_v7.0.6.0_full_intl.exe	28
PID 1952 wrote to memory of 2856	1952	nox_setup_v7.0.6.0_full_intl.exe	28
PID 1952 wrote to memory of 2856	1952	nox_setup_v7.0.6.0_full_intl.exe	28

C:\Users\Admin\AppData\Local\Temp\nox_setup_v7.0.6.0_full_intl.exe
"C:\Users\Admin\AppData\Local\Temp\nox_setup_v7.0.6.0_full_intl.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe
  "C:\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe "
  2⤵
  - Executes dropped EXE
  PID:2856

C:\Users\Admin\AppData\Local\Temp\NOX4D37.tmp

Filesize
2KB

MD5
f529dd5c9109598721d753efaf306acd

SHA1
69aacdef7ebb9a1f974b659c8831a59107538dcc

SHA256
dfd55944df560ef7d1d9bb058f03e0d80e53a9d4eca0461cd67077da25f680c0

SHA512
689d35f0ca1889e52e55dbd50d5ae646ad8b52ad78cd76159a96508b7a4837c6d0a632584a462b4bfcd4676e7fbb62ac78d4b839874b5ed05ff36416dbe0c514

Download Submit
\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe

Filesize
60KB

MD5
ac0f922fd1f2bbd56d96f602ae44e28c

SHA1
e18b6cd5b630f65148342699048c21cc9f111187

SHA256
15868cd72d0acff143b6101772190428927781334bbf6218465ed526544d76b6

SHA512
222e7e29d5829bccfdb5d49ac48d5359be7abd985eedb53aba5a514cc67ccfb6c4288108d008da5244ea9901dc29ae6d28092fa3a2002fa63b69cf87eb440989

Download Submit