b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/libfido2-nodejs.dll
Size

521KB
MD5

10ddcb2631d543e04033d2ba185dda67
SHA1

e021f1da6eda9ac26545d98941b7f7b1fe177d2f
SHA256

a2943d3507c6abd8ded082ccc45ca3f3e9e553e87605f113014b1e62acb8efaa
SHA512

ffb27a968ea33ae2b9ac01edc1c6b819f02f60b24a20347fde90b22ddc2eb78d954ccbbd537112a7b81ef0b4ee355b675bd1d53b07d4f2462748fbf16095d96d
SSDEEP

12288:R+zxwvwC/EHAUPQe4NJ0sC8X9y2xnIxH8+Ixu0fl7jAg:OmvwFC9y2xl7jD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2488 2052 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2488	2052	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1048 wrote to memory of 2052	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 2052	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 2052	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 2052	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 2052	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 2052	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 2052	1048	rundll32.exe	rundll32.exe
PID 2052 wrote to memory of 2488	2052	rundll32.exe	WerFault.exe
PID 2052 wrote to memory of 2488	2052	rundll32.exe	WerFault.exe
PID 2052 wrote to memory of 2488	2052	rundll32.exe	WerFault.exe
PID 2052 wrote to memory of 2488	2052	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\libfido2-nodejs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\libfido2-nodejs.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 268
    3⤵
    - Program crash
    PID:2488