b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
119s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/keytar/win-ia32/keytar.dll
Size

115KB
MD5

da698607c47fc6c765ab1fae782521d8
SHA1

7b277fc7b086016f176e42b925f215898f38d666
SHA256

bbd551f2950a407a834c15eeb7c71a818a6fd866dd24b16fc0ba135407f84fdd
SHA512

3a0a2d44f6746dcc3d983637a703cf005428e18025324c344593d3430e9eab98ec756fb9456fc393da5bf61b2744582d82634199241ef80a8675d20ba522f421
SSDEEP

3072:BKHnhWXw0a4PvawDIjHpl0whj4g8X/TNptYtPd:cHnh8w/IaVp14vPtY1d

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2420 1856 WerFault.exe rundll32.exe
2820 1856 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2420	1856	WerFault.exe	rundll32.exe
2820	1856	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2240 wrote to memory of 1856	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 1856	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 1856	2240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\keytar\win-ia32\keytar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\keytar\win-ia32\keytar.dll,#1
  2⤵
  PID:1856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 568
    3⤵
    - Program crash
    PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 804
    3⤵
    - Program crash
    PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1856 -ip 1856
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1856 -ip 1856
1⤵
PID:4356