ramnit | 8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95

Analysis

max time kernel
129s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 00:07

Target

8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95.dll
Size

38KB
MD5

72632cb81b920a2acbd32a969f7d6e3a
SHA1

7d476904a576a0a13d3ddfab9e2799a79c83acd4
SHA256

8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95
SHA512

b2275b66d4c0d0f63e211ffd16c6b560f6d50f5aacc156945fdcae1d3f92d98ae46cd2cd97084114b632c80883120f6f0ff2e90369cbc1bcd3645b012b0ab4a5
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7CsXUN76m2sBVV:WD8w22laSR0V+3CJrVdXO7zJ

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3152 1392 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
3152	1392	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4736 wrote to memory of 1392	4736	rundll32.exe	rundll32.exe
PID 4736 wrote to memory of 1392	4736	rundll32.exe	rundll32.exe
PID 4736 wrote to memory of 1392	4736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8850e284300611ac4bb7f36d3e156236d7baf8bae58ba657ea1a8d6b992eda95.dll,#1
2⤵
- Drops file in System32 directory
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 580
3⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1392 -ip 1392
1⤵
PID:3032

memory/1392-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download