4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
125s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/zlib1.dll
Size

174KB
MD5

0efc8bd2b6c2d1a9d058887e3b80ab05
SHA1

d4eee29a2395b03a061e8cee125234fefdeddae6
SHA256

a63a24302cc9b690955bec2d0a481d1a8c030bd7dd1d2f7c0a68dd6cfe4cd1b6
SHA512

064382851d4b45e83654b32ded1b2a77f1072e748da48a85c8dd2ac4548937f4a4ebbcdfecf453d46d4fad71bddeb866d04e423d918ea368a4590f6e8941387a
SSDEEP

3072:kja8am40isQsJCqLsh12oMo/aoF9GdXaicmwD70B1Bc6JfJTBfaiFZQilKBCRMRf:T8LisVJDseydaajN83cgTBCiFyCC8u

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4432	1984	WerFault.exe	74

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 1984	3300	rundll32.exe	74
PID 3300 wrote to memory of 1984	3300	rundll32.exe	74
PID 3300 wrote to memory of 1984	3300	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\zlib1.dll,#1
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 616
    3⤵
    - Program crash
    PID:4432