redline | 3028-54-0x0000000000300000-0x00000000003CF000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3028-54-0x0000000000300000-0x00000000003CF000-memory.dmp
Size

828KB
MD5

a368e6f439eee28df29d2d98a3305987
SHA1

5e2980ff22a37eab8c8220c2ee9e2df3e85fd392
SHA256

08a379d475f2c9471691f5ee9329ccf03be346b235d5ea86e35e290a3f45895f
SHA512

8da48c01a3050d53ecc876a3eed1b9e71617889de1a042b6b7d2966e092bd9c11685b6bc70286b19318d7f76e43422f82a99a52d4e8276ad7d8fae989d106323
SSDEEP

24576:ObsKZUQ92dxWr1r9GUIQ7CVBM037NI0fq3RF:Obl92dxWrJ9GlBzq3v

Score

10^/10

redline

Malware Config

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3028-54-0x0000000000300000-0x00000000003CF000-memory.dmp

Files

3028-54-0x0000000000300000-0x00000000003CF000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 522KB - Virtual size: 522KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.LLK
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ