ramnit | a591674c093d591394b0564ac4fa10827896ee2b8f596b086fa356c79f6bd2f4

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 01:26

Target

a591674c093d591394b0564ac4fa10827896ee2b8f596b086fa356c79f6bd2f4.dll
Size

38KB
MD5

9867465d51eccfebb3f2d7533a5e6dae
SHA1

a7948715795354d5bd4db8bee0bb1b43b5bb35eb
SHA256

a591674c093d591394b0564ac4fa10827896ee2b8f596b086fa356c79f6bd2f4
SHA512

c3dc526a5f46a9db7e41edf1735382ffd08f08f235adf934241c625b84457563c0babac084a7ffe71a7248b2d40b08943d6288d95e461d3147e9900a6082af4b
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV79IXU76m2sIRVV:WD8w22laSR0V+3CJrVIXczJI

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2776 1472 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
2776	1472	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2084 wrote to memory of 1472	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1472	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 1472	2084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a591674c093d591394b0564ac4fa10827896ee2b8f596b086fa356c79f6bd2f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a591674c093d591394b0564ac4fa10827896ee2b8f596b086fa356c79f6bd2f4.dll,#1
2⤵
- Drops file in System32 directory
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 616
3⤵
- Program crash
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1472 -ip 1472
1⤵
PID:3612

memory/1472-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download