b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/libfido2-nodejs.dll
Size

521KB
MD5

10ddcb2631d543e04033d2ba185dda67
SHA1

e021f1da6eda9ac26545d98941b7f7b1fe177d2f
SHA256

a2943d3507c6abd8ded082ccc45ca3f3e9e553e87605f113014b1e62acb8efaa
SHA512

ffb27a968ea33ae2b9ac01edc1c6b819f02f60b24a20347fde90b22ddc2eb78d954ccbbd537112a7b81ef0b4ee355b675bd1d53b07d4f2462748fbf16095d96d
SSDEEP

12288:R+zxwvwC/EHAUPQe4NJ0sC8X9y2xnIxH8+Ixu0fl7jAg:OmvwFC9y2xl7jD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4620 2340 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4620	2340	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 640 wrote to memory of 2340	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 2340	640	rundll32.exe	rundll32.exe
PID 640 wrote to memory of 2340	640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\libfido2-nodejs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\libfido2-nodejs.dll,#1
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 616
    3⤵
    - Program crash
    PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2340 -ip 2340
1⤵
PID:3224