b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/zlib1.dll
Size

174KB
MD5

26a9f5d5fa561b4a1afbd1a681b09847
SHA1

fe1d1df3731bec49ee26ab9eeee4e4585a75e505
SHA256

dad8b2f1c80449a72d5411ca24496931e3cd8ac481606f324d88c756ccaf78de
SHA512

796a185d9e3f2a5fb2e0d14e476b4670fd838b00a165541bf57a6d7b87787dc71e0611f43f4da0019810c230dc479f37ec3f51e247c37f4a24ea9640eb4d34a5
SSDEEP

3072:GF+X1LQ+sQsJCqLsh12oMo/aoF9GdXaicmwD70B1Bc6JftTBf/iFZQilQBNRMR8M:G+++sVJDseydaajN83cYTBHiFYNC8M

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 2604 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1756	2604	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 888 wrote to memory of 2604	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 2604	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 2604	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 2604	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 2604	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 2604	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 2604	888	rundll32.exe	rundll32.exe
PID 2604 wrote to memory of 1756	2604	rundll32.exe	WerFault.exe
PID 2604 wrote to memory of 1756	2604	rundll32.exe	WerFault.exe
PID 2604 wrote to memory of 1756	2604	rundll32.exe	WerFault.exe
PID 2604 wrote to memory of 1756	2604	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\zlib1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 224
    3⤵
    - Program crash
    PID:1756