agenttesla | 312-441-0x0000000004EF0000-0x0000000004F44000-memory[.]dmp | Triage

Sharing

General

Target

312-441-0x0000000004EF0000-0x0000000004F44000-memory.dmp
Size

336KB
MD5

28a4c8e44143d75467548d604379c2b8
SHA1

058c39feec7aa2e35fe764bfcb9afabc114fbc6a
SHA256

cb9c5a51325469923243e05d759d721d0aaa0c44059780ec26394eab69914d40
SHA512

038e71a4df03dd45f872d8fe74bfa1f16ebddbd96606a3f5c6ddeb6fc6c7515c50419df34a33ec454619c1f1e216d8db0eb664534dd54eb8804b38051f5012b0
SSDEEP

6144:zVvOKuamaiaNUvD8YlPQPlRCCAKLtslu9dk2CK:zV2Kuamai8AVlclRCeef2

Score

10^/10

agenttesla

Malware Config

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
312-441-0x0000000004EF0000-0x0000000004F44000-memory.dmp

Files

312-441-0x0000000004EF0000-0x0000000004F44000-memory.dmp
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

_.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ