b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/crypto-46.dll
Size

1.4MB
MD5

1a655aca77bcfad2a53ed76a40fc9b2f
SHA1

c7cf2cf970022243077bb99c1489f2fe835c8422
SHA256

6d86a8066924f6bffe0db358f432e8bc134d75c4a9a2b3398fda592a3060d53f
SHA512

11e785065d8ee01f2911c09b80d4773a32915092c32d21b0ebaa43f83c67e02b5681152f94d467d8646719587d544036d319d77bd23e0b270686a2bc498b72a4
SSDEEP

24576:6wtkU3PGPEyPSRBktRdQGMkKd6EKVjUv+P647Nru/8kidIXDRNvKJ5uvHlne18Pu:fZyqotRdFqKVYWP647Nru5XDRNvKJ5uy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2720 wrote to memory of 2560	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\crypto-46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\crypto-46.dll,#1
  2⤵
  PID:2560