c5269585dc48ce9e11bf4e4a5df5312ecdc94fc458d9dbb1883fad3b2ef18445

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 12:14

Target

leagueoflengends.exe
Size

5.3MB
MD5

049400d4ef38908cb8b71336c36a79eb
SHA1

c6ddb85fdecd8950ccd419f876fef5e1c92ffce7
SHA256

c5269585dc48ce9e11bf4e4a5df5312ecdc94fc458d9dbb1883fad3b2ef18445
SHA512

68fe1593824d128cecfe24e29fe181144bd423f16203da9c645b70916db600f89a32599e39b7b9596d15ab8abc1f786388e8b9e0eae32f7500fae477bbcdaf81
SSDEEP

98304:fnNruYrKIDTGpzoLLJ3TbwaVvrZE0IdeyoFQK15W8ASLmbNYJERw1jrTHa1DiHYu:fnNruYeIm9onJ5hrZEReyiU8AdZYJERV

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2580	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2580	1708	leagueoflengends.exe	29
PID 1708 wrote to memory of 2580	1708	leagueoflengends.exe	29
PID 1708 wrote to memory of 2580	1708	leagueoflengends.exe	29

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
  "C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
  2⤵
  - Loads dropped DLL
  PID:2580

C:\Users\Admin\AppData\Local\Temp\_MEI17082\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit