Analysis

  • max time kernel
    110s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 16:57

General

  • Target

    lolxc/LOL星辰辅助V9.4【超强脚本+超强躲避】/使用说明/插件注册失败打开.bat

  • Size

    28B

  • MD5

    16610974828b7bbff2b1a28c3cdd0b37

  • SHA1

    8c368cfda55ea7ce1723e7e11d1cf5c9963e1694

  • SHA256

    95283d484cf1d97318cbd6ae8da7f4ed5739012025cd6519e832fe3b50bf6e5e

  • SHA512

    fd8c88650679f4263fbcddbfd793c22d4aac89e5caf4e03c29773dd1b0b6df27238d5cc74cdccb3a62c9bb986608cf23afe94a4bcfd341d044788d33b9923cd8

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\lolxc\LOL星辰辅助V9.4【超强脚本+超强躲避】\使用说明\插件注册失败打开.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\system32\regsvr32.exe
      regsvr32 "C:\windows\XC.dll"
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2332-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB