b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/cbor.dll
Size

180KB
MD5

d5d9f069feae15e01517d87af1ccd3ae
SHA1

6a7ec842de5a49fe90ee4fa3a9ca2235067b3ef2
SHA256

d0d24ba7ebfca5c050dbfd08df5519df8c8ae4f275188b01aa63eb28686b4934
SHA512

ac0a346df7d8512a551e825922a489dd6d990208c7665455c7318155576cb2699891a58b5b12ea4bd27e2ac5f3429b9abae3166b36942f84b558362ac1363835
SSDEEP

3072:WfzKUbDcqIfV4E54DIPQePucoINTpuqc2lv9HGjCv+GcAgnXl61x8aZTTVAopszT:WK9GjNWUXkyaZTppeiex6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2224 2220 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2224	2220	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 328 wrote to memory of 2220	328	rundll32.exe	rundll32.exe
PID 328 wrote to memory of 2220	328	rundll32.exe	rundll32.exe
PID 328 wrote to memory of 2220	328	rundll32.exe	rundll32.exe
PID 328 wrote to memory of 2220	328	rundll32.exe	rundll32.exe
PID 328 wrote to memory of 2220	328	rundll32.exe	rundll32.exe
PID 328 wrote to memory of 2220	328	rundll32.exe	rundll32.exe
PID 328 wrote to memory of 2220	328	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2224	2220	rundll32.exe	WerFault.exe
PID 2220 wrote to memory of 2224	2220	rundll32.exe	WerFault.exe
PID 2220 wrote to memory of 2224	2220	rundll32.exe	WerFault.exe
PID 2220 wrote to memory of 2224	2220	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\cbor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\cbor.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 220
    3⤵
    - Program crash
    PID:2224