redline | 2028-148-0x0000000000E50000-0x0000000000E96000-memory[.]dmp | Triage

Sharing

General

Target

2028-148-0x0000000000E50000-0x0000000000E96000-memory.dmp
Size

280KB
MD5

36ed9ac82dda4971a17c6c5f7df1333f
SHA1

3c9c78c2d023b0c852b3d6266a9953b334a74488
SHA256

2cf0091ef820ae66b1915e946b61c466f7650c6e98b623e7618fa17194f3f264
SHA512

ac35d0a20af81f33d4fae0060f004df2dbfb3995df2c04810956f49ae95f64ecf1db1eff1dda217725b4ccd771827ccf1a22a47ac1aba36ee1bb839219ff6de8
SSDEEP

3072:9n6jIELf6FDTCjhnTzO6w/et1WuDCvgxo40TnCch36nycRt7fwxNn2pU9f2MKTVr:R6jocuVe3W8Y2chqnycP

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

2028-148-0x0000000000E50000-0x0000000000E96000-memory.dmp
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ