Behavioral task
behavioral1
Sample
448-3-0x0000000000060000-0x0000000000652000-memory.exe
Resource
win7-20240508-en
General
-
Target
448-3-0x0000000000060000-0x0000000000652000-memory.dmp
-
Size
5.9MB
-
MD5
47f5869966b8ba9af9d0cad9bde4bd7e
-
SHA1
eb8c42f42ac88dd594c1d6c06f843bc82c581373
-
SHA256
26a753b65eb3d53e8198d3c6536d1b60d5d3efb89b9e5d0670510cf03b0f3a3b
-
SHA512
b94092be5aaf2c24a3dbb70f6d2dce1266cc8c976de1cbc7066350a1b005971659c975186dde1ffd2ee3bde8a9a389b04bfffbd3a20ba66cc4e0b4bb42168aea
-
SSDEEP
98304:oZfq2pDHFOL1jmoQLZGKB8qsZ7zDXdBaqwmtpHPyEszm9Lhr7JawvH:abpDlO5jbQLZGKEBaq/nvqzqLhvJLv
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 448-3-0x0000000000060000-0x0000000000652000-memory.dmp
Files
-
448-3-0x0000000000060000-0x0000000000652000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cqymewea Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uepqumkm Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE