Behavioral task
behavioral1
Sample
1632-56-0x0000000000B70000-0x0000000000BB0000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1632-56-0x0000000000B70000-0x0000000000BB0000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1632-56-0x0000000000B70000-0x0000000000BB0000-memory.dmp
-
Size
256KB
-
MD5
fcfc47d4ce01c616e43393ea453561b5
-
SHA1
3e94055eee8b17754b73e39a057283b1d07b65c8
-
SHA256
ad946dd1f702e01ef6ee6f01eacfc915093e64fa59368c46131d7b35b285fbeb
-
SHA512
08b4015de627cb7dd48176ef8a669d196841b08a777f2304000f4ee50462a3280c10526e127f5ee4f702371f8b9609c83946939e1c7eb2d7583e9b52bf8b7ea5
-
SSDEEP
3072:V8e8hCL8L1Uo+qVAw9v4IzKi+8e8hC1Io28us8Wk2b:VZSOo+HdIzKi+j28oa
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1632-56-0x0000000000B70000-0x0000000000BB0000-memory.dmp
Files
-
1632-56-0x0000000000B70000-0x0000000000BB0000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ