4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
127s
max time network
144s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/fido2.dll
Size

225KB
MD5

057a0b7293ae60f58151baf322711c2c
SHA1

6d5ec2d345cb930ed4ddf5f1108047377b018dd6
SHA256

850a71f1053c617f2c93ec2300d2802fa06ea934117d37823d636eef42493fb4
SHA512

f5b80870d87a072e5dcf3ac5a30bfcc392eab9d478965cf33332f7104f0b9f2a0828ab609440c1a10660bfcddf421c79b37f0a36f337f9ef43cf37c035e10baf
SSDEEP

3072:mfvYjfgLOq2dMcChh7fM3TK8NqTq/zYykZEx5kcFOGQbe+mqIf+s6IAFvn6YhW:Egj9Q1v8QTUYy4oucobsV0hW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4896 3604 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4896	3604	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3584 wrote to memory of 3604	3584	rundll32.exe	rundll32.exe
PID 3584 wrote to memory of 3604	3584	rundll32.exe	rundll32.exe
PID 3584 wrote to memory of 3604	3584	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\fido2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\fido2.dll,#1
2⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 636
3⤵
- Program crash
PID:4896