Behavioral task
behavioral1
Sample
3812-3-0x00000000007B0000-0x0000000000D8C000-memory.exe
Resource
win7-20240611-en
General
-
Target
3812-3-0x00000000007B0000-0x0000000000D8C000-memory.dmp
-
Size
5.9MB
-
MD5
765f50a423d49873139343329783d105
-
SHA1
ea1d33c52952a9d8a5fd1d66e4c0b40098c39132
-
SHA256
13609393740532bef5fcb3d5317abd4e74f1d9e781a364ebfab85c9555e6cb6c
-
SHA512
d07fdaeb37dcaa2841ab021295e52f5e785b42b09a41d43d0c1624afd9c04cbaf73c355a04869537e097f5f3d212f528ed7f20f8c5971afa45e2b21d45ed933a
-
SSDEEP
98304:ZUSjLHtHnX+1dNhQLleTBBBleoCey+CNZOYFYUFUxQYkvnLI/0+ZtGmdlhIqZQmR:SqHtHXSd3QLlefAy0+ZBzpZQu
Malware Config
Signatures
-
Risepro family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3812-3-0x00000000007B0000-0x0000000000D8C000-memory.dmp
Files
-
3812-3-0x00000000007B0000-0x0000000000D8C000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 685KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiawvfvz Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rgordhrj Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE