b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/tls-20.dll
Size

128KB
MD5

402e0ad5882c25ca84fe8c6e5d8d30f3
SHA1

fec93750632d662e6a513fb7261ce2180a308d04
SHA256

e4edd485bbbe05024435e9ea3737c7665d588251fe06c2b02365f6d036fb6aca
SHA512

326f759bfb0c3337332cf1b74b22df9aafa78d68e2e45c6c1d70cc685797a8a005cf5c762c72eda92a579f4befceb4e54500e12709ce90f59f3d20c6dd558962
SSDEEP

3072:w3a8MstIEHAzRroP6+VabbvW4eB/4PGIQthj:wq836BiPbVVBj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2752 1560 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2752	1560	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2488 wrote to memory of 1560	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1560	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1560	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1560	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1560	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1560	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1560	2488	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 2752	1560	rundll32.exe	WerFault.exe
PID 1560 wrote to memory of 2752	1560	rundll32.exe	WerFault.exe
PID 1560 wrote to memory of 2752	1560	rundll32.exe	WerFault.exe
PID 1560 wrote to memory of 2752	1560	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\tls-20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\tls-20.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 240
    3⤵
    - Program crash
    PID:2752