5f264a460eb68d7dd313f7068d3975e5f6cd809bd8bbd5dc8f82a366d5abec5a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 20:39

Target

leagueoflengends.exe
Size

5.3MB
MD5

41ac0de283505cf5712957a5a16d0c59
SHA1

40e7ba03369ebaa97bb6852300e3a6f8c27f97d4
SHA256

5f264a460eb68d7dd313f7068d3975e5f6cd809bd8bbd5dc8f82a366d5abec5a
SHA512

de6c7a47446955af40449e91627e852d0879743b950b4fdcedc2da2a4ad67c5fa7b73514e78a85215240ca069be2062235f8c682ccc120297bd7a1c0e543f515
SSDEEP

98304:SnnruarKIDTGpzoLLJ3TbwaVvrZE0IdeyoFQK15W8ASLmbNYJERw1jrTH+1DE8IY:SnnruaeIm9onJ5hrZEReyiU8AdZYJERD

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

leagueoflengends.exe

pid process

2168 leagueoflengends.exe

pid	process
2168	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 2820 wrote to memory of 2168	2820	leagueoflengends.exe	leagueoflengends.exe
PID 2820 wrote to memory of 2168	2820	leagueoflengends.exe	leagueoflengends.exe
PID 2820 wrote to memory of 2168	2820	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:2168

C:\Users\Admin\AppData\Local\Temp\_MEI28202\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit