redline | 3232-118-0x0000000004B50000-0x0000000004BAA000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3232-118-0x0000000004B50000-0x0000000004BAA000-memory.dmp
Size

360KB
MD5

f649ed06f93502a781f2cf319d46f8ac
SHA1

891d3b1bca2cd9e6edca288f8514a2e54d3dd8ec
SHA256

72af4bf41e07314830785d120bc66705af481687bc8adf73e6660f9e1bdc0797
SHA512

e795065491ff643d823cc7c17c10b829c44898b2f488d870af5a3d1e96882ba9ab5a3f887c17b1532ffdc64f1cc258399e2ef1c256e45b9d41164f53ac4c2b6f
SSDEEP

1536:4TSSWLq5TgceqTkSw1zuaJFs1+Kv3DF2iYYoRy2GYMoVXLgUbYvg0r+ipEhHp69S:4BuU2iaJudTF23/TGSLh5yn2a4kArBJ

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

3232-118-0x0000000004B50000-0x0000000004BAA000-memory.dmp
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ