redline | 3824-141-0x00000000004E0000-0x0000000000599000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3824-141-0x00000000004E0000-0x0000000000599000-memory.dmp
Size

740KB
MD5

f529e799c105bc6670ad360eb8982447
SHA1

65f5c49193a61016dd8e52b85f6c34e10b3abf5b
SHA256

51814d760ce701cc936af22fbac4e91d73e5e4fa3c9d4266f6623bc76e69db15
SHA512

1f8f15e4abb7994c7c745df4a6c0de5dd48a67351f1f7357fc0b5dcc7e550b557d62acc640a8ccecf6ce4970497d51233dbfa5abcae4fcfc383a4f52e643f28d
SSDEEP

12288:u2Kb4mqvCf36ENjjeWVrRPw5jP5nw4v+p0fACGx2I+u4qdH8dYGM87+jVbZbm2f:u2Kb4XvCf36ENe95n92p0fAKIPcdYG1y

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

3824-141-0x00000000004E0000-0x0000000000599000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 472KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 146KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ