f8c1c02945789544eecd9bcb100fecc47a6d4a221aa895a6a220b1447dbea81f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 19:11

Target

leagueoflengends.exe
Size

5.3MB
MD5

000e381867f125a210176ea88dfe718c
SHA1

76c58dd7461d74ba4b2fe5f035e577d7621f76f7
SHA256

f8c1c02945789544eecd9bcb100fecc47a6d4a221aa895a6a220b1447dbea81f
SHA512

493237dc1eba15ca445be99d1510cb8e0ee2fc0224194560570ab0682e0cd581393d844dab34f2a49246b884d3e6bf1ed7b3c7f6a4f2b9a98bd9781de11e59c4
SSDEEP

98304:TnyruQrKIDTGpzoLLJ3TbwaVvrZE0IdeyoFQK15W8ASLmbNYJERw1jrTH+1DE8IY:TnyruQeIm9onJ5hrZEReyiU8AdZYJERD

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

leagueoflengends.exe

pid process

2572 leagueoflengends.exe

pid	process
2572	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 3028 wrote to memory of 2572	3028	leagueoflengends.exe	leagueoflengends.exe
PID 3028 wrote to memory of 2572	3028	leagueoflengends.exe	leagueoflengends.exe
PID 3028 wrote to memory of 2572	3028	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:2572

C:\Users\Admin\AppData\Local\Temp\_MEI30282\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit