ramnit | 7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:29

Target

7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060.dll
Size

38KB
MD5

64f17e453b784330575f2635afeab3fc
SHA1

4be2b02f05eb899c23ae572048488dbc578409be
SHA256

7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060
SHA512

09fc365c7af129f0f9bd2f12adb3c13ca4f410c8cb7c62c7cb33f7fe47df4ba03c0c6510f4b68168040a580b2dbef6442210bd84f510b6883ddb501531ad5fff
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7QhXU76m2sZaVV:WD8w22laSR0V+3CJrVGXczJZ

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2060 3064 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
2060	3064	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3800 wrote to memory of 3064	3800	rundll32.exe	rundll32.exe
PID 3800 wrote to memory of 3064	3800	rundll32.exe	rundll32.exe
PID 3800 wrote to memory of 3064	3800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a0e26e007b27b01f63fb57bc61fd92dcb71236de0872a84194ba25ddc3c1060.dll,#1
2⤵
- Drops file in System32 directory
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 580
3⤵
- Program crash
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3064 -ip 3064
1⤵
PID:1476

memory/3064-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download