agenttesla | 2912-16-0x00000000008D0000-0x0000000000926000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2912-16-0x00000000008D0000-0x0000000000926000-memory.dmp
Size

344KB
MD5

4d803e77af8677caf14689a6b4ab30cd
SHA1

821afc61dd7cafff63295f1778bed1eda221e169
SHA256

82b5bd7aa5e6f2e02e26d567aa3a72b3ea5725f97198e58c4da398195675b5d8
SHA512

68f8403875752f8fd2543515c9721f160f4d22c1b8af1decefb15ba958e5db45859e6bb5d3ca07f3bc61ab267d3c0d75626db4b4f5fca559fe250705e55e23f2
SSDEEP

3072:O1PRzYeXQm2mmGGoSREu6AqKb7gYI41lhh3QUlnHUo+DRn302C5tr/OYodsVC:yRzYeXQm2mmGGowgYhxvln0j30v+

Score

10^/10

agenttesla

Malware Config

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2912-16-0x00000000008D0000-0x0000000000926000-memory.dmp

Files

2912-16-0x00000000008D0000-0x0000000000926000-memory.dmp
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

_.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 314KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ