agenttesla | 5020-12-0x0000000002CB0000-0x0000000002D04000-memory[.]dmp | Triage

Sharing

General

Target

5020-12-0x0000000002CB0000-0x0000000002D04000-memory.dmp
Size

336KB
MD5

7ce6856e3801c01f1aa7d92dcf4d3909
SHA1

fdb15c889c441f6a70ea972c60e2208b5409b9e8
SHA256

f370524f5cb85f45247719e72ac65dd70751ab82abea5bdf36dfbd16cb6a066d
SHA512

b804becfe013e2f05d7f8c51e8ca07aea425bba8a00cad8c014d03b3f9b85304f84a3b6823b49980a047fbfc5336b24489dd3c70a85813c5823aa6c3c585230a
SSDEEP

3072:VzDFs40WtsKh+7Wgvq5A5Py/0MqRekWxdb3lXs7Dmg1tIt5sBhAGaeI:VFs40osK8WT5AS6RK3l87f3N

Score

10^/10

agenttesla

Malware Config

Signatures

Agenttesla family
agenttesla

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5020-12-0x0000000002CB0000-0x0000000002D04000-memory.dmp

Files

5020-12-0x0000000002CB0000-0x0000000002D04000-memory.dmp
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

_.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 307KB - Virtual size: 307KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ