Behavioral task
behavioral1
Sample
1372-56-0x0000000004260000-0x00000000042A0000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1372-56-0x0000000004260000-0x00000000042A0000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1372-56-0x0000000004260000-0x00000000042A0000-memory.dmp
-
Size
256KB
-
MD5
6a6330cfd85859a9303a68b539bad14a
-
SHA1
417635f03da18d4271bc0632a14bf9ee49479072
-
SHA256
816c2ca1cd2c3f345cc7d0d22bf9bb90c91d91521be380fb9195ccda587ff9d8
-
SHA512
1e9f70c3561f878d59dde6c112db668703c642892f4edf90dabaad580f71cbf12057794e72698bf2c1ff216a1efaae769d64bc2dd0eb0a8d90899965f0945a29
-
SSDEEP
3072:a8e8h79h1DSE6RZHSSSSSSS8SSSSSSSSSSSSSySSSSqSSSSSSSSSSSSSSSSSSSSf:achuHbp9PCw9j/Sd
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1372-56-0x0000000004260000-0x00000000042A0000-memory.dmp
Files
-
1372-56-0x0000000004260000-0x00000000042A0000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ