4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
127s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/crypto-46.dll
Size

1.4MB
MD5

d9aa5789cbe34a176d54d6dc5becf57e
SHA1

3e5a87324e4c40e0557a20d8ed7b2800f1020360
SHA256

7a9f53aa3538a4547ac29db37067a74b5059439ae5b8860a614ec8bb79b1175d
SHA512

0c5479d08535f487a9ea1daf2a8a77c046e6dd86d273413d1d3ac4afe76673227628ed25724e3e63cd8d756ea5b1b0c88e265e29f3ee4c2df3ddd60414a26ac1
SSDEEP

24576:zyx8nkZgVU1Y4bgaxmDKmOIgfAkGCK0jX8uv+PlH7NrJ/G6idIXDRNvKJ5uvHln6:+jBnxGKppK0ouWPlH7NrJ9XDRNvKJ5uI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4668	1560	WerFault.exe	73

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1560	4108	rundll32.exe	73
PID 4108 wrote to memory of 1560	4108	rundll32.exe	73
PID 4108 wrote to memory of 1560	4108	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\crypto-46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\crypto-46.dll,#1
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 632
    3⤵
    - Program crash
    PID:4668