b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/tls-20.dll
Size

128KB
MD5

402e0ad5882c25ca84fe8c6e5d8d30f3
SHA1

fec93750632d662e6a513fb7261ce2180a308d04
SHA256

e4edd485bbbe05024435e9ea3737c7665d588251fe06c2b02365f6d036fb6aca
SHA512

326f759bfb0c3337332cf1b74b22df9aafa78d68e2e45c6c1d70cc685797a8a005cf5c762c72eda92a579f4befceb4e54500e12709ce90f59f3d20c6dd558962
SSDEEP

3072:w3a8MstIEHAzRroP6+VabbvW4eB/4PGIQthj:wq836BiPbVVBj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2088 2228 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2088	2228	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2076 wrote to memory of 2228	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2228	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 2228	2076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\tls-20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\tls-20.dll,#1
  2⤵
  PID:2228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 616
    3⤵
    - Program crash
    PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2228 -ip 2228
1⤵
PID:656