9f5b49077538805122ff961139c794f39f04e4e56ba7363c60b8368365a7d1d2

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 19:08

Target

leagueoflengends.exe
Size

5.2MB
MD5

b6fdfe64902bda936e50236b7856a5db
SHA1

e57c68daf4a73c4d0627f6b4ca86a9e4f3ea1f6d
SHA256

9f5b49077538805122ff961139c794f39f04e4e56ba7363c60b8368365a7d1d2
SHA512

bc70b09e73494ecbc5f95b53bc5b8618911f81a961a14ea9eeceed584e0ecbb7d31b411dc51b97be5355bdcd3de86e3124354b224585610f9ccc815c172f1cba
SSDEEP

98304:Xnwru6KIDTGpzoLLJ3TbwaVvrZE0I7yoFQK15W8ASLmbNYJERw1jrTH61DYZY:XnwruhIm9onJ5hrZEnyiU8AdZYJERur0

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

leagueoflengends.exe

pid process

2876 leagueoflengends.exe

pid	process
2876	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 2928 wrote to memory of 2876	2928	leagueoflengends.exe	leagueoflengends.exe
PID 2928 wrote to memory of 2876	2928	leagueoflengends.exe	leagueoflengends.exe
PID 2928 wrote to memory of 2876	2928	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:2876

C:\Users\Admin\AppData\Local\Temp\_MEI29282\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit