4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
135s
max time network
144s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/tls-20.dll
Size

128KB
MD5

270cc25782b778f53b21fbf1d116e20a
SHA1

ccbcf50655e8d773068199af869f4be162a229ff
SHA256

8202200e32ca225cee525579c86258c91b2d094e78707ee3b4f1c588fea3ae62
SHA512

abd38386504b2317a96f71315a7c067949bacb97699d69a9372eaa2ee90ba17816098ac307ed7d184057e4638aafddcfab8844de70c28f7107bde40c682424ba
SSDEEP

3072:Ja8MstIEHAzRroP6+VabbvW4eB/4PGIQThj:w836BiPbVVPj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2356 3024 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2356	3024	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4528 wrote to memory of 3024	4528	rundll32.exe	rundll32.exe
PID 4528 wrote to memory of 3024	4528	rundll32.exe	rundll32.exe
PID 4528 wrote to memory of 3024	4528	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\tls-20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\tls-20.dll,#1
2⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 632
3⤵
- Program crash
PID:2356