7c6852f2c9965304b02bd9c3e124c466951948a06924b545f82bb3c967125d20

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 20:54

Target

leagueoflengends.exe
Size

7.9MB
MD5

0a294356dc04829c39db11e2a1be90ef
SHA1

64ba5e389c5b29806906a02fc0813a091e19b4c8
SHA256

7c6852f2c9965304b02bd9c3e124c466951948a06924b545f82bb3c967125d20
SHA512

a469fcfe8630394cb4f3487d354165aa3a1e1d8543484d7b7746e90c2cbbf6b7ec4895b377725e1e7312730ea72d558456d9135f34ff9e67fed5f5a91b766f92
SSDEEP

196608:JnaruzeIX69onJ5hrZEReyiU8AdZYJERS48RmU/ITvN8wZlsPvZPrTcY:ErkK9c5hlERuAdZYygtNITfZWZr4Y

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

leagueoflengends.exe

pid process

1560 leagueoflengends.exe

pid	process
1560	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 1736 wrote to memory of 1560	1736	leagueoflengends.exe	leagueoflengends.exe
PID 1736 wrote to memory of 1560	1736	leagueoflengends.exe	leagueoflengends.exe
PID 1736 wrote to memory of 1560	1736	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:1560

C:\Users\Admin\AppData\Local\Temp\_MEI17362\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit