Behavioral task
behavioral1
Sample
1044-56-0x0000000000530000-0x0000000000542000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1044-56-0x0000000000530000-0x0000000000542000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1044-56-0x0000000000530000-0x0000000000542000-memory.dmp
-
Size
72KB
-
MD5
56841a006be2c71aa206a9c50b9fa20b
-
SHA1
ee2147ec4402550a93f7fad81206d96f3a4f08f9
-
SHA256
762d0321576408a255b0b97e19336d122d0dafc243bdb698c1bdb19b0d02694d
-
SHA512
c51937a6f786a374253ff4911911d653bac5836e3338fc87fd3ca5694143f1a528751753c37821b08e17039f8297fcc4cf4067cd0370f542316a3f450fabc0fa
-
SSDEEP
768:RD+q7EILuCCj+DiJOsebKAiLQ8YbYgvf1e0JvEgK/JkwVc6KN:p+vrJGKwzbP00JnkJkwVclN
Malware Config
Extracted
asyncrat
1.0.7
WindowsDefenderSmarttScreen
217.64.31.3:9742
WindowsDefenderSmarttScreen
-
delay
1
-
install
false
-
install_file
WindowsDefenderSmarttScreen.exe
-
install_folder
%AppData%
Signatures
Files
-
1044-56-0x0000000000530000-0x0000000000542000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ