e3f2f0455958438009b8d81269e59b8ba52de86d6be364b219eaaf462f7e5083

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 19:13

Target

leagueoflengends.exe
Size

5.3MB
MD5

d8e29a483b0e939daa8620fa9551f229
SHA1

3272efc1e60fb6e65295b94530e0f72ec05e9b21
SHA256

e3f2f0455958438009b8d81269e59b8ba52de86d6be364b219eaaf462f7e5083
SHA512

62cc4fb9cc93adfe76e0e176c9687c0c3a3ca42629f3a1172e4dcab95eff85f7b4d235e19612ce1bef2ba6429a60160b88a4240583221b90c4269dd2515b0e6e
SSDEEP

98304:3nzruErKIDTGpzoLLJ3TbwaVvrZE0IdeyoFQK15W8ASLmbNYJERw1jrTH+1DE8IY:3nzruEeIm9onJ5hrZEReyiU8AdZYJERD

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2348	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2348	1688	leagueoflengends.exe	29
PID 1688 wrote to memory of 2348	1688	leagueoflengends.exe	29
PID 1688 wrote to memory of 2348	1688	leagueoflengends.exe	29

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
  "C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
  2⤵
  - Loads dropped DLL
  PID:2348

C:\Users\Admin\AppData\Local\Temp\_MEI16882\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit