4616-73-0x00000000027D0000-0x0000000002815000-memory.dmp
- SHA256 2315cb24aa7c90c9352242a23afed2f70dcbe392f090bd7104c08471bae6a164
-
Detects DonutLoader
Behavioral task
behavioral1
Sample
4616-73-0x00000000027D0000-0x0000000002815000-memory.dmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
4616-73-0x00000000027D0000-0x0000000002815000-memory.dmp
Resource
win11-20260513-en
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
| resource | yara_rule |
|---|---|
| sample | family_donutloader |
Detects DonutLoader