Behavioral task
behavioral1
Sample
1256-56-0x0000000000DC0000-0x0000000000E00000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1256-56-0x0000000000DC0000-0x0000000000E00000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1256-56-0x0000000000DC0000-0x0000000000E00000-memory.dmp
-
Size
256KB
-
MD5
ae4d86f7851393a82a1ef736475f38df
-
SHA1
38a152cc43a28d7e6ae79c27e45a57baeaf735a4
-
SHA256
e2a69a6b088dbe6466161062ded7a2d4c12552c672715f2fd68bbf0125cf46c7
-
SHA512
0b95f93c67914c71f8bce90e489520d9aa5c13e447de424b828dad3ecbf89f0b65229610eb3055cc2c8af25e758181b528f90145b733b35106220cdb7c89fdbb
-
SSDEEP
3072:u8e8huZQDEXrWS0qVyMAFWqsvP2mwQn8e8hu13b2AH8WzV:uTQIIJ0P2mwQnX3b5NV
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1256-56-0x0000000000DC0000-0x0000000000E00000-memory.dmp
Files
-
1256-56-0x0000000000DC0000-0x0000000000E00000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ