b00278fa7ce17131c37c2aac88ea0d4fab6931852449540965c68435ded33060

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 21:05

Target

leagueoflengends.exe
Size

7.9MB
MD5

bc5886c662bd600dd07ba22dab10d608
SHA1

bf25d5f2fb78f316352a625804eb6087ac50d1f7
SHA256

b00278fa7ce17131c37c2aac88ea0d4fab6931852449540965c68435ded33060
SHA512

18a4154b4ef527df758186e9a563df7cc1f9c64131d2c51950f3b3f2dbdfa4fe6b26e3444ba4cb99bebc8c4d981ad62874aebc0cc79584a5edaa28fd1182ff4d
SSDEEP

196608:Untru0eIX69onJ5hrZEReyiU8AdZYJERS48RmU/ITvN8wZlsPvZPrTcY:srbK9c5hlERuAdZYygtNITfZWZr4Y

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

leagueoflengends.exe

pid process

1516 leagueoflengends.exe

pid	process
1516	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

leagueoflengends.exe

description	pid	process	target process
PID 2288 wrote to memory of 1516	2288	leagueoflengends.exe	leagueoflengends.exe
PID 2288 wrote to memory of 1516	2288	leagueoflengends.exe	leagueoflengends.exe
PID 2288 wrote to memory of 1516	2288	leagueoflengends.exe	leagueoflengends.exe

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
2⤵
- Loads dropped DLL
PID:1516

C:\Users\Admin\AppData\Local\Temp\_MEI22882\python39.dll
Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit