b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
139s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/fido2.dll
Size

225KB
MD5

5c7cc2752ef1c854357b0d6b6adbc210
SHA1

452d6564b0e5aeb0d5b4e535186b46170ec7a7fb
SHA256

c0d3e49e26093460a8d8643ee0b745bf5f7904410c79a428a528d913eb76161c
SHA512

ee7798d30a1089c57c4b6c96f3954cb259ae6b04f7e2c6cb2aad1e96e0ed56250118b8380585cf30b061e30b500e013733e02dfab90e8cf1fae8e419f9b7fb03
SSDEEP

3072:zfvYjfgLOq2dMcChh7fM3TK8NqTq/zYykZEx5kcFOGQbe+mqIf+s6IAPvn6YhW:rgj9Q1v8QTUYy4oucobsV2hW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	4532	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4532	1060	rundll32.exe	90
PID 1060 wrote to memory of 4532	1060	rundll32.exe	90
PID 1060 wrote to memory of 4532	1060	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\fido2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\fido2.dll,#1
  2⤵
  PID:4532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 616
    3⤵
    - Program crash
    PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4532 -ip 4532
1⤵
PID:4640