f6259330c8322e116de96c0342b128086b9042fd5d60d7f1e7a1bc6c4c9509a6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 19:18

Target

leagueoflengends.exe
Size

5.3MB
MD5

6d609a4b52eda885ac62f4375e3dd90f
SHA1

7130d727c351bdb079f3d72eb08d77bc685e00b7
SHA256

f6259330c8322e116de96c0342b128086b9042fd5d60d7f1e7a1bc6c4c9509a6
SHA512

3e9432b8b81690a1b1778f5877bf40244852f3c092156f71056ef85a60c0261048c81055d81ec8e2423af239f1a60867184c34bcebbb6022d72059044a395ee0
SSDEEP

98304:hndruorKIDTGpzoLLJ3TbwaVvrZE0IdeyoFQK15W8ASLmbNYJERw1jrTH+1DE8IY:hndruoeIm9onJ5hrZEReyiU8AdZYJERD

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

leagueoflengends.exe

pid process

2608 leagueoflengends.exe

pid	process
2608	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 1948 wrote to memory of 2608	1948	leagueoflengends.exe	leagueoflengends.exe
PID 1948 wrote to memory of 2608	1948	leagueoflengends.exe	leagueoflengends.exe
PID 1948 wrote to memory of 2608	1948	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:2608

C:\Users\Admin\AppData\Local\Temp\_MEI19482\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit