b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
120s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/crypto-46.dll
Size

1.4MB
MD5

1a655aca77bcfad2a53ed76a40fc9b2f
SHA1

c7cf2cf970022243077bb99c1489f2fe835c8422
SHA256

6d86a8066924f6bffe0db358f432e8bc134d75c4a9a2b3398fda592a3060d53f
SHA512

11e785065d8ee01f2911c09b80d4773a32915092c32d21b0ebaa43f83c67e02b5681152f94d467d8646719587d544036d319d77bd23e0b270686a2bc498b72a4
SSDEEP

24576:6wtkU3PGPEyPSRBktRdQGMkKd6EKVjUv+P647Nru/8kidIXDRNvKJ5uvHlne18Pu:fZyqotRdFqKVYWP647Nru5XDRNvKJ5uy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2136 232 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2136	232	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2836 wrote to memory of 232	2836	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 232	2836	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 232	2836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\crypto-46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\crypto-46.dll,#1
  2⤵
  PID:232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 612
    3⤵
    - Program crash
    PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 232 -ip 232
1⤵
PID:2296