agenttesla | 2204-19-0x0000000000390000-0x00000000003E4000-memory[.]dmp | Triage

Sharing

General

Target

2204-19-0x0000000000390000-0x00000000003E4000-memory.dmp
Size

336KB
MD5

cad42efc47f768e1c7b28cacbc96a584
SHA1

6088734012a18a3e8fbde2d4a57670ff7e0de63c
SHA256

21da6ef227d2d0055a5219423065b39d15a94606e7744abf59b283b40bfed63f
SHA512

e2fae7cfcb72c436a71f4f84970ce2437f34c54cb3f87f761b9845e643dc89820fa4be17dfe7b7aaac3b526c67ef1c617f7279eef00bd69eee3b26a02ea60b33
SSDEEP

6144:KoGQBauqWqj3ZhrQOdz5es4QoLOgCtawfllwywXKsesgc:OQauqWqjJfd9esto3wNf6Km

Score

10^/10

agenttesla

Malware Config

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2204-19-0x0000000000390000-0x00000000003E4000-memory.dmp

Files

2204-19-0x0000000000390000-0x00000000003E4000-memory.dmp
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

_.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 310KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ