4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
128s
max time network
138s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/libfido2-nodejs.dll
Size

522KB
MD5

1dbf34ad2f295409284625bbc2e8b047
SHA1

2f13dc62b9cdf3dfa8bc9461dd15ebfbe96407e7
SHA256

68384af68d84e83da4c62964b6ddc0e0e0495d8492e72bd242ee1ac3f7c3c067
SHA512

b9c91d4e9242a45444a6bfe7e0b009d042d3822de37c96f6fe21560ea1fe80de6997116a3aa6c0cfe81c7170e3b721064fd7de5342df8f44165bcc9930ab36c8
SSDEEP

12288:XV5Y2vufkpt+VEYupSNNBR8mNZcvAdJt2ZLeu0P/XH2Dg:lG2vUP8mzcvAPXHL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4988 212 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4988	212	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4724 wrote to memory of 212	4724	rundll32.exe	rundll32.exe
PID 4724 wrote to memory of 212	4724	rundll32.exe	rundll32.exe
PID 4724 wrote to memory of 212	4724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\libfido2-nodejs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\libfido2-nodejs.dll,#1
2⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 640
3⤵
- Program crash
PID:4988