7a1e93456fcb76f826eea08c2ab2e7cb43d8ecda782a97520bd85d1faa864d08

Analysis

max time kernel
298s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 13:57

Target
Novara.exe
Size 168.6MB
Sample260806-q9nvqaxtdv
SHA256 7a1e93456fcb76f826eea08c2ab2e7cb43d8ecda782a97520bd85d1faa864d08
MD5 d398028a8bc781de5d338fae95d2deb4
SHA1 a98359c84db7d01b7aa7eeef5920c5f35ce27ada
SHA512 40be7cb0082c5eb0408c7b02e8554472893b13e05dec4e8f8a8db76bb16d2d748e5fabef8c3ab4b9be156a6e8078047267dec7b01df90cb4e916b5632945948c
SSDEEP 1572864:kOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:WgmeNxNNZxqV
TLSH
T13E887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4160	Novara.exe
Token: SeCreatePagefilePrivilege	4160	Novara.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 1540	4160	Novara.exe	88
PID 4160 wrote to memory of 116	4160	Novara.exe	89

C:\Users\Admin\AppData\Local\Temp\Novara.exe
"C:\Users\Admin\AppData\Local\Temp\Novara.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\Novara.exe
  "C:\Users\Admin\AppData\Local\Temp\Novara.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\novara-platform" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1692 --field-trial-handle=1696,i,17476275165737198238,6294135395702996309,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\Novara.exe
  "C:\Users\Admin\AppData\Local\Temp\Novara.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\novara-platform" --mojo-platform-channel-handle=1768 --field-trial-handle=1696,i,17476275165737198238,6294135395702996309,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  PID:116