4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
146s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/cbor.dll
Size

180KB
MD5

e004b0df1216acd143851c4b69b7dea3
SHA1

aa4b8f9d4f29b19e521a0c766714c02e0e3d70ed
SHA256

db32c80110d514e6c4357d201107a9277c2269b05aadb6a451df6fcf6b611377
SHA512

2d8eba626452b1c3f14a57db72bf66f546bfffc6ff92c7b05ec22b0082c9cf3439c991c026d4ed417835818e11b95bb408a69f20f9676d3f5afd9374f725df94
SSDEEP

3072:5fzKUbDcqIfV4E54DIPQePucoINTpuqc2lv9HGjCv+GcAgnXl61x8aZTTVAopszI:5K9GjNWUXkyaZTppeiexh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	3032	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3032	4660	rundll32.exe	72
PID 4660 wrote to memory of 3032	4660	rundll32.exe	72
PID 4660 wrote to memory of 3032	4660	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\cbor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\cbor.dll,#1
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 616
    3⤵
    - Program crash
    PID:3924