1f9f3b5c96c20a482dbcc52d7211877f052ac193df28a02455f9dbd1789efbdb

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 23:23

Target

leagueoflengends.exe
Size

8.1MB
MD5

1c2dc4140896136fd0129001da53ec1b
SHA1

d759b9a463326ee72bd62ebef367559473044e4b
SHA256

1f9f3b5c96c20a482dbcc52d7211877f052ac193df28a02455f9dbd1789efbdb
SHA512

30bc272dfa6370b36dfb2b6844131313358d9d40064e6255deb0922913c68f61d064b8d05e81a05e58fb82d185f5b22362cc393284b490935ef3aef6155643fd
SSDEEP

196608:Vngru1XeIX69onJ5hrZEReyiU8AdZYJERD48RmU/ITvN8wZlsPvZPrTdQlY:+rqnK9c5hlERuAdZYydtNITfZWZrhEY

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

leagueoflengends.exe

pid process

2408 leagueoflengends.exe

pid	process
2408	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 3048 wrote to memory of 2408	3048	leagueoflengends.exe	leagueoflengends.exe
PID 3048 wrote to memory of 2408	3048	leagueoflengends.exe	leagueoflengends.exe
PID 3048 wrote to memory of 2408	3048	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:2408

C:\Users\Admin\AppData\Local\Temp\_MEI30482\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit