8e4cbc1921c67a4da479c6719584b0c0191bef5854e902179b45ac4cf9c3a9df

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 21:10

Target

leagueoflengends.exe
Size

8.1MB
MD5

04c89e8fe2e5f70706b7313cf45d9f42
SHA1

8af2876b0d37e12e29e804a63fc38950acb3a27c
SHA256

8e4cbc1921c67a4da479c6719584b0c0191bef5854e902179b45ac4cf9c3a9df
SHA512

5dc141b7ec70dc7dcfa529c64c715e15c6e5d702978b99c20b4e60843536f43d9e1d35d28092bd7326cf220d433c655d39d1c0eab8ef04c3e85a2d7e8cc156af
SSDEEP

196608:4nAruDXeIX69onJ5hrZEReyiU8AdZYJERD48RmU/ITvN8wZlsPvZPrTd7Y:hrUnK9c5hlERuAdZYydtNITfZWZrh7Y

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1756	leagueoflengends.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1756	1772	leagueoflengends.exe	29
PID 1772 wrote to memory of 1756	1772	leagueoflengends.exe	29
PID 1772 wrote to memory of 1756	1772	leagueoflengends.exe	29

C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
"C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe
  "C:\Users\Admin\AppData\Local\Temp\leagueoflengends.exe"
  2⤵
  - Loads dropped DLL
  PID:1756

C:\Users\Admin\AppData\Local\Temp\_MEI17722\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit