agenttesla | 2680-12-0x0000000000BA0000-0x0000000000BF4000-memory[.]dmp | Triage

Sharing

General

Target

2680-12-0x0000000000BA0000-0x0000000000BF4000-memory.dmp
Size

336KB
MD5

6e4ddf6baee3113f87c6c47801ba2af9
SHA1

432b0556d0d8eb12aaebc48280873fd423fffb95
SHA256

4106244b31b46bb62c1dbde8e12bea4d913bfb596c3f187022d28ef6964f68df
SHA512

c3b16a839b3888687d8ef64fe53b59bd1d93eb5d02552a4cb2187b6e976a8afb19f7d5d12db486304633208f1f526c264c86245e048afc7f6ab8ff8dc60c8b2f
SSDEEP

6144:61wTjNuYflb7zjbl6uah1XqyA+0BW0/DjJD23l/re+o:E8b7zjbEtfqyP3su8+o

Score

10^/10

agenttesla

Malware Config

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2680-12-0x0000000000BA0000-0x0000000000BF4000-memory.dmp

Files

2680-12-0x0000000000BA0000-0x0000000000BF4000-memory.dmp
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

_.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 309KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ