7191bacce32bac868401f96bdcf0c59275951ba2ceabc27e295d3c9ccd9c0474

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 00:57

Target

$PLUGINSDIR/nitltkq.dll
Size

33KB
MD5

6af5e7b9a184d0be2697ce73e4785fe4
SHA1

2d3828288bd07abf1d44105fbbff2d3101fa40eb
SHA256

3cf2b5d1e973b29a24fb05f608046e483f008cd0861246bc6367c1507bb4a672
SHA512

33baa87d649f9eebd54c4aa9a75e5e4a6c9e36b5197ad4b6a757e8c1aa4810dd81a59d4cb64257a131892d725919ef8874f6c664d7f066878b4030338fc3dcf5
SSDEEP

384:A/o2SnW4B7jeRReTXIWD9Cc8NuYXAVckDLDll+RPaaWnktmdnZq4aIzeWU9ae77D:v2E9JjKPaaWktG81e9e/5ufbVW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5048 4520 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5048	4520	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2244 wrote to memory of 4520	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 4520	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 4520	2244	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nitltkq.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nitltkq.dll,#1
2⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 700
3⤵
- Program crash
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4520 -ip 4520
1⤵
PID:4356