redline | 1004-55-0x0000000002210000-0x0000000002290000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1004-55-0x0000000002210000-0x0000000002290000-memory.dmp
Size

512KB
MD5

4afb3c00bf3d9180752b909db7c61bc8
SHA1

af5e7552cdd2b90eb378799e16812b065f275e49
SHA256

a6381eaaace1fa9a0ae7d6a0ca4b7d28e84eb14c1a3c01bd0b74302151827088
SHA512

3f3c643a5a10844a2677b2d0164a950b68d33a00b753e0b642bbb79ec51d72cab84d99c9ee81127e19fc7835880b51cddaea329c15418a615c9ec9b2c8c3f4ac
SSDEEP

12288:328fOSbZyfBWWPWiSqwyoUAHKr9nrmF4ZzX+1nVu671cPW5m1Tue6Qj:328byV+F16j

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

1004-55-0x0000000002210000-0x0000000002290000-memory.dmp
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ