Behavioral task
behavioral1
Sample
1488-1302-0x000000001B140000-0x000000001B1C0000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1488-1302-0x000000001B140000-0x000000001B1C0000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1488-1302-0x000000001B140000-0x000000001B1C0000-memory.dmp
-
Size
512KB
-
MD5
d04d39ab7a39bec2535199ca30f2fc08
-
SHA1
2a7ce75cd10ffe367eec1969f1178d7af5e22f23
-
SHA256
7ec6cb13f62d8d331dca996c2acc53f3695b89944a213ef00147f2928bbdaad2
-
SHA512
488301e6740747803f65cf5dc898dc943cf78d16bdc1446b6e9f94e1d4e236897ef65866581c87e04b0ec2496eec8a73ac6feeec1f1721d80fed96bacbf7f41e
-
SSDEEP
3072:dJthJNmyJthJN4JthJNGorbkSppkUOZy8Q2orbkSXpkUOZ:dJthD7JthD4JthDbbTXrbl
Malware Config
Signatures
-
Gurcu family
Files
-
1488-1302-0x000000001B140000-0x000000001B1C0000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ