67c7772ab157f70d0af2ea190030f39bcac03ec0606faaf9b142c064497e804b

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 17:08

Target

NovaCheatAi1.exe
Size

7.5MB
MD5

146f40432003937e528c3125801bc54e
SHA1

a0a4980b5828aa85267fb52c13d9226cb3121915
SHA256

67c7772ab157f70d0af2ea190030f39bcac03ec0606faaf9b142c064497e804b
SHA512

7c04dcbf1eb855a1105592ce8edfb840254ac3a2e4c07d2754999596d7cd5af4f94f7cdadf4658a2565bb78dcef291d04fd583a85ccce8c0cbe49781a68594b2
SSDEEP

196608:CfgVVEg8wfI9jUC2gYBYv3vbW2+iITx1U6n/:7VVEgjIH2gYBgDWJTnz/

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

NovaCheatAi1.exe

pid	Process
2948	NovaCheatAi1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x000500000001938a-21.dat	upx
behavioral1/memory/2948-23-0x000007FEF6490000-0x000007FEF6B55000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

NovaCheatAi1.exe

description	pid	Process	procid_target
PID 2932 wrote to memory of 2948	2932	NovaCheatAi1.exe	30
PID 2932 wrote to memory of 2948	2932	NovaCheatAi1.exe	30
PID 2932 wrote to memory of 2948	2932	NovaCheatAi1.exe	30

C:\Users\Admin\AppData\Local\Temp\NovaCheatAi1.exe
"C:\Users\Admin\AppData\Local\Temp\NovaCheatAi1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\NovaCheatAi1.exe
  "C:\Users\Admin\AppData\Local\Temp\NovaCheatAi1.exe"
  2⤵
  - Loads dropped DLL
  PID:2948

C:\Users\Admin\AppData\Local\Temp\_MEI29322\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2948-23-0x000007FEF6490000-0x000007FEF6B55000-memory.dmp

Filesize
6.8MB

Download