Behavioral task
behavioral1
Sample
624-56-0x00000000008A0000-0x00000000008E0000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
624-56-0x00000000008A0000-0x00000000008E0000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
624-56-0x00000000008A0000-0x00000000008E0000-memory.dmp
-
Size
256KB
-
MD5
67f4140c12f3b150fd011d3e4b86a15f
-
SHA1
927208156939ff54de12d4cdc072e8c5230b791e
-
SHA256
cac355be86f061a07d5afc850a7ed240d9777879587c4b644a872334c2a028c3
-
SHA512
6499343241d2597a3992dbf45c8b28194162745896aba6a974d4235e599e7d0383d2bb6ba2a750fca10869b062dde1d816fb14258ff4efd6af6a46bca4ac0608
-
SSDEEP
3072:l8e8h5k7VemQ6p8Wc6+yoIyqCqVMEODInQ6Fx8e8h5l:l75emBY6oIyvjGnQ6FxM
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 624-56-0x00000000008A0000-0x00000000008E0000-memory.dmp
Files
-
624-56-0x00000000008A0000-0x00000000008E0000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ