Analysis
-
max time kernel
1562s -
max time network
1563s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 23:28
Behavioral task
behavioral1
Sample
league of legends.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
league of legends.exe
Resource
win10v2004-20240508-en
General
-
Target
league of legends.exe
-
Size
5.2MB
-
MD5
52c0e4218367789067b5fd8c7d13b5c9
-
SHA1
10a0b1b53e0447875404a0a4d813e02d78c1089e
-
SHA256
f29bb95cd3cc9507c6d056c5223ec9bf521c52e961a11f9ca779c430a6fb1b14
-
SHA512
c0b73db1a1bfa13e8b45d8291435b14a2d68b5f9854bef895ef1f3aa930d880ee76abf02a0a85968f7ba154915d6ae091836c1f72f5c7b26a79b007c4a120219
-
SSDEEP
98304:knwrufKIDTGpzoLLJ3TbwaVvrZE0I7yoFQK15W8ASLmbNYJERw1jrTHD1DlrY31:knwruiIm9onJ5hrZEnyiU8AdZYJERur0
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2500 league of legends.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2500 2908 league of legends.exe 29 PID 2908 wrote to memory of 2500 2908 league of legends.exe 29 PID 2908 wrote to memory of 2500 2908 league of legends.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\league of legends.exe"C:\Users\Admin\AppData\Local\Temp\league of legends.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\league of legends.exe"C:\Users\Admin\AppData\Local\Temp\league of legends.exe"2⤵
- Loads dropped DLL
PID:2500
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD511c051f93c922d6b6b4829772f27a5be
SHA142fbdf3403a4bc3d46d348ca37a9f835e073d440
SHA2560eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c
SHA5121cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6