4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
125s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/libtermius/win-ia32/termius.dll
Size

3.3MB
MD5

011ab6239e1ca6431c06d7fffe98a6cc
SHA1

83806e29f7a25645a782d3856b361fa3556afdc9
SHA256

e1245a3606becd0fb3a9caaa77753e3a7253edc85ef0f87e6cbaf98d801215f0
SHA512

d917d324152ecd5aa9761412578d0351f022b5bf9855c14f72e784375e91f971cde069ca1e4a8a589df505dd476eaf6697e722acf90f59aa580ecde9afd9f23b
SSDEEP

49152:FZ0Q1N88dZ1/drY4p+F+ktNf1Er16/v/ghDp9gsiP+JsklnWuj4rKbvVzSTsGy1k:goM1Er16/v/gT9gsrP4roVzzG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3480	196	WerFault.exe	74

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 200 wrote to memory of 196	200	rundll32.exe	74
PID 200 wrote to memory of 196	200	rundll32.exe	74
PID 200 wrote to memory of 196	200	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libtermius\win-ia32\termius.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libtermius\win-ia32\termius.dll,#1
  2⤵
  PID:196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 196 -s 644
    3⤵
    - Program crash
    PID:3480