4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
139s
max time network
161s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/mosh/win-ia32/moshclient.dll
Size

1.2MB
MD5

ab42390942edb5130f1933568c0418d4
SHA1

0e90ba403dbed6f46c5e55e2b8d79267939e8f9c
SHA256

2501366297bf361f7f43a217363559fb1ab2090b59acf65ca91f3ca43ebc911c
SHA512

2d2deff7d6de90fdc361f4b584fb3e8a77241fdf091447176c049ac3109aad18e9993037f54479f599bc6e7cc48c718db5b34114513edb14cdb48cbf06732206
SSDEEP

24576:1FyHHLef2JCS1YoDibo9XWP/Tw1sjgL7RwokHTt:vyHHLeeJCH4WzgNwo4Tt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

428 2104 WerFault.exe rundll32.exe

pid	pid_target	process	target process
428	2104	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5104 wrote to memory of 2104	5104	rundll32.exe	rundll32.exe
PID 5104 wrote to memory of 2104	5104	rundll32.exe	rundll32.exe
PID 5104 wrote to memory of 2104	5104	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\mosh\win-ia32\moshclient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\mosh\win-ia32\moshclient.dll,#1
2⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 632
3⤵
- Program crash
PID:428