b159761b935b8900da7dd255b75788c23f435e9f484e4fc38856edd4bab3faea

Analysis

max time kernel
141s
max time network
230s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 14:53

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/zlib1.dll
Size

174KB
MD5

26a9f5d5fa561b4a1afbd1a681b09847
SHA1

fe1d1df3731bec49ee26ab9eeee4e4585a75e505
SHA256

dad8b2f1c80449a72d5411ca24496931e3cd8ac481606f324d88c756ccaf78de
SHA512

796a185d9e3f2a5fb2e0d14e476b4670fd838b00a165541bf57a6d7b87787dc71e0611f43f4da0019810c230dc479f37ec3f51e247c37f4a24ea9640eb4d34a5
SSDEEP

3072:GF+X1LQ+sQsJCqLsh12oMo/aoF9GdXaicmwD70B1Bc6JftTBf/iFZQilQBNRMR8M:G+++sVJDseydaajN83cYTBHiFYNC8M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	3336	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 3336	1588	rundll32.exe	87
PID 1588 wrote to memory of 3336	1588	rundll32.exe	87
PID 1588 wrote to memory of 3336	1588	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\zlib1.dll,#1
  2⤵
  PID:3336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 600
    3⤵
    - Program crash
    PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3336 -ip 3336
1⤵
PID:3920