ramnit | 9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 00:52

Target

9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874.dll
Size

38KB
MD5

60e960b86310c8f90ab482de7c5d6b08
SHA1

70e7867d16a72e6de16b55b23c6a017eaadab819
SHA256

9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874
SHA512

14205dac40d6a828ccffae2573d98f844873bbe534f6e4b1948f9d8ae6f7de7ef91d080dcf0cc810106a25230a796079bad5c2a5ab16fa896f747a7051d6902b
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7LIXUN6m2sZMVV:WD8w22laSR0V+3CJrVuXazJZ

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1052 3480 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
1052	3480	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4444 wrote to memory of 3480	4444	rundll32.exe	rundll32.exe
PID 4444 wrote to memory of 3480	4444	rundll32.exe	rundll32.exe
PID 4444 wrote to memory of 3480	4444	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9953182b68cb49448f71d29c4e104cf8a91a367dcdddfaf1385e70fbdd80b874.dll,#1
2⤵
- Drops file in System32 directory
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 604
3⤵
- Program crash
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3480 -ip 3480
1⤵
PID:4956

memory/3480-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download