7191bacce32bac868401f96bdcf0c59275951ba2ceabc27e295d3c9ccd9c0474

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 00:57

Target

$PLUGINSDIR/nitltkq.dll
Size

33KB
MD5

6af5e7b9a184d0be2697ce73e4785fe4
SHA1

2d3828288bd07abf1d44105fbbff2d3101fa40eb
SHA256

3cf2b5d1e973b29a24fb05f608046e483f008cd0861246bc6367c1507bb4a672
SHA512

33baa87d649f9eebd54c4aa9a75e5e4a6c9e36b5197ad4b6a757e8c1aa4810dd81a59d4cb64257a131892d725919ef8874f6c664d7f066878b4030338fc3dcf5
SSDEEP

384:A/o2SnW4B7jeRReTXIWD9Cc8NuYXAVckDLDll+RPaaWnktmdnZq4aIzeWU9ae77D:v2E9JjKPaaWktG81e9e/5ufbVW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1808 1216 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1808	1216	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1732 wrote to memory of 1216	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1216	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1216	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1216	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1216	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1216	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1216	1732	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 1808	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 1808	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 1808	1216	rundll32.exe	WerFault.exe
PID 1216 wrote to memory of 1808	1216	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nitltkq.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nitltkq.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 260
3⤵
- Program crash
PID:1808