pid[.]15412[.]wow64con[.]dll[.]0x1048090[.]0x7ff9a9ac0000[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

pid.15412.wow64con.dll.0x1048090.0x7ff9a9ac0000.dmp
Size

88KB
MD5

849049aded31638d0073d26cc4b7499f
SHA1

3887881ebaeedf9432a300a0f2a3cd0618bc6726
SHA256

e765c4f3d2e90a5066187e087a03830acf34935b26da6e860ab0a3b30b1a132f
SHA512

2aecc9cb858031c94dbbd8eded0a0d8ce96343e8d73e1c524a7418c6f25b014ed8bca6c2fca36d29b490bbac88fa9f25d0b4dd0761b670032df61e23f9406102
SSDEEP

96:tBieuAiUeI05dD/qrP8C1/1HBwOzN7tDNlJBSkup4gIM9dwNvRc:/iUATD/qn1NHeOB7tFBSkG4ZSMvS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pid.15412.wow64con.dll.0x1048090.0x7ff9a9ac0000.dmp

Files

pid.15412.wow64con.dll.0x1048090.0x7ff9a9ac0000.dmp
.dll windows:10 windows x64 arch:x64

e9ea7f9fbced140cf08f995d64e11a39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

wow64con.pdb

Imports

ntdll

__C_specific_handler
CsrClientConnectToServer
LdrDisableThreadCalloutsForDll
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
CsrClientCallServer
RtlNtStatusToDosError

wow64win

NtWow64UserConnectHook

Exports

Exports

sdwhcon

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ