b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/fido2.dll
Size

225KB
MD5

5c7cc2752ef1c854357b0d6b6adbc210
SHA1

452d6564b0e5aeb0d5b4e535186b46170ec7a7fb
SHA256

c0d3e49e26093460a8d8643ee0b745bf5f7904410c79a428a528d913eb76161c
SHA512

ee7798d30a1089c57c4b6c96f3954cb259ae6b04f7e2c6cb2aad1e96e0ed56250118b8380585cf30b061e30b500e013733e02dfab90e8cf1fae8e419f9b7fb03
SSDEEP

3072:zfvYjfgLOq2dMcChh7fM3TK8NqTq/zYykZEx5kcFOGQbe+mqIf+s6IAPvn6YhW:rgj9Q1v8QTUYy4oucobsV2hW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2772 1744 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2772	1744	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1680 wrote to memory of 1744	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1744	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1744	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1744	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1744	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1744	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1744	1680	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 2772	1744	rundll32.exe	WerFault.exe
PID 1744 wrote to memory of 2772	1744	rundll32.exe	WerFault.exe
PID 1744 wrote to memory of 2772	1744	rundll32.exe	WerFault.exe
PID 1744 wrote to memory of 2772	1744	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\fido2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\fido2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 268
    3⤵
    - Program crash
    PID:2772