b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
130s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/cbor.dll
Size

180KB
MD5

d5d9f069feae15e01517d87af1ccd3ae
SHA1

6a7ec842de5a49fe90ee4fa3a9ca2235067b3ef2
SHA256

d0d24ba7ebfca5c050dbfd08df5519df8c8ae4f275188b01aa63eb28686b4934
SHA512

ac0a346df7d8512a551e825922a489dd6d990208c7665455c7318155576cb2699891a58b5b12ea4bd27e2ac5f3429b9abae3166b36942f84b558362ac1363835
SSDEEP

3072:WfzKUbDcqIfV4E54DIPQePucoINTpuqc2lv9HGjCv+GcAgnXl61x8aZTTVAopszT:WK9GjNWUXkyaZTppeiex6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3236 2916 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3236	2916	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 400 wrote to memory of 2916	400	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 2916	400	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 2916	400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\cbor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\cbor.dll,#1
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 600
    3⤵
    - Program crash
    PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2916 -ip 2916
1⤵
PID:3924