ramnit | 46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 21:12

Target

46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a.dll
Size

38KB
MD5

eaf79519edf23a96e9adee63728d0919
SHA1

3354a587013838085bab0e2d1948b62f526287c3
SHA256

46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a
SHA512

7a831de96d4d17d1289fa39f78940781ee50f6dbe816b090a8e40837203def0b4e93999f8c532c565471d783324dd2ee9c82d506ea0eac2ab2129d4c0b4a9e6b
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7WIXUU6m2spNVV:WD8w22laSR0V+3CJrVZXjzJp

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2540 2144 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
2540	2144	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1804 wrote to memory of 2144	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 2144	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 2144	1804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46c3ecca40673389f32be3265cc46faae523de13fb8d70e9c65477b8bbcb576a.dll,#1
2⤵
- Drops file in System32 directory
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 608
3⤵
- Program crash
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2144 -ip 2144
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4452

memory/2144-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download