ramnit | b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 02:08

Target

b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb.dll
Size

38KB
MD5

474d62f3cc9bad3328e0011e24aef7ed
SHA1

fedac51d8f8bb220107c0a1e1eda87fd99307e78
SHA256

b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb
SHA512

8e70b1f689af017fecc1a0c504b675d90f55cf4698ee0f85957e70679ad38d582bdb5e60e8eaff0dad7e7af5b1f6a3cd6079c3bb278cc7f3b8d4e5fd994c3a98
SSDEEP

768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV74IXUG6m2sLnVV:WD8w22laSR0V+3CJrVjXRzJL

Score

10^/10

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2872 2812 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dmlconf.dat	rundll32.exe

pid	pid_target	process	target process
2872	2812	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4600 wrote to memory of 2812	4600	rundll32.exe	rundll32.exe
PID 4600 wrote to memory of 2812	4600	rundll32.exe	rundll32.exe
PID 4600 wrote to memory of 2812	4600	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7d06da96466eae0245b8d665e7f2b1779e72667ff549cc5373422b17de342cb.dll,#1
2⤵
- Drops file in System32 directory
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 616
3⤵
- Program crash
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2812 -ip 2812
1⤵
PID:2696

memory/2812-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download