Behavioral task
behavioral1
Sample
3448-9-0x0000000000400000-0x000000000087E000-memory.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3448-9-0x0000000000400000-0x000000000087E000-memory.exe
Resource
win10v2004-20240426-en
General
-
Target
3448-9-0x0000000000400000-0x000000000087E000-memory.dmp
-
Size
4.5MB
-
MD5
d84bb7e705bccb4a991ae2b84f81ee15
-
SHA1
53bafa5ba93d36c2e6e7d2c1e34a625748d7292d
-
SHA256
6669061eba648c847bec08b69a3b86b6372e577cf628b0861e98f1e33e0d2cd8
-
SHA512
061951ec2b98ad2382a9bfebc0aa7f66bb7f4bcacbe9f6a87ccecae3b0619dc6976b883c03f3adc7e8d782449b7c57908d6e58b18479a41fd9eb6ee81ab0920a
-
SSDEEP
98304:u9zgL2wil+lVUpGNIE1D3jSXi6UBtTxolCByotG3oHgB:sM2wil+vUpGNIE1D3jbTDohos3
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3448-9-0x0000000000400000-0x000000000087E000-memory.dmp
Files
-
3448-9-0x0000000000400000-0x000000000087E000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 721KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ