77310cefb84be481384796490372e5f9cb84d548b45a2514110161a7f2f2f22a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 21:37

Target

leagueoflengends.exe
Size

8.1MB
MD5

cf5054da62129afcadff2fb82ca518ad
SHA1

3caf9ba52727fecef7d1a6f8d860327ffe409aa7
SHA256

77310cefb84be481384796490372e5f9cb84d548b45a2514110161a7f2f2f22a
SHA512

ee92e55b7093088a8b43bda9910e8534cdb019334b96c7ef0e218367450ff4482b5ee92ab0f825d5617aeaca002e4125af4df8232dcded74087abcebc9f02a6c
SSDEEP

196608:VnuruzXeIX69onJ5hrZEReyiU8AdZYJERD48RmU/ITvN8wZlsPvZPrTd7Y:krGnK9c5hlERuAdZYydtNITfZWZrh7Y

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

leagueoflengends.exe

pid process

1676 leagueoflengends.exe

pid	process
1676	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 1632 wrote to memory of 1676	1632	leagueoflengends.exe	leagueoflengends.exe
PID 1632 wrote to memory of 1676	1632	leagueoflengends.exe	leagueoflengends.exe
PID 1632 wrote to memory of 1676	1632	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:1676

C:\Users\Admin\AppData\Local\Temp\_MEI16322\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit