4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
122s
max time network
146s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/windows-iap-bridge/win-ia32/binding.dll
Size

706KB
MD5

d0bed07d11ea06d6bf4ac0baa228c4de
SHA1

33f3c3bb0f2789981c5297dba66505dc008605fb
SHA256

c1b244c395c03d29774593d7d9fa7183a9bf06f06970e7d06243ad5b74e38880
SHA512

3da2e1b7171f4a9a60e9871eb5a5b53b0f690c139d9f9ab771ea06e20a207981497c078cf44184369b9ea71abae17fa77bc7c0045c5bb6846c7e4a978e59fdfd
SSDEEP

6144:i0Rs4zCbge4GzRElPAuZU6ON2NKeUPXcyoq2Z6DBwJYfZrmVKuDsutn9Ulda9qLZ:i0DGOJAuZUXNX/cyoq2Z6DsIuDsudCZ

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3060 1520 WerFault.exe rundll32.exe
5028 1520 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3060	1520	WerFault.exe	rundll32.exe
5028	1520	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4708 wrote to memory of 1520	4708	rundll32.exe	rundll32.exe
PID 4708 wrote to memory of 1520	4708	rundll32.exe	rundll32.exe
PID 4708 wrote to memory of 1520	4708	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\win-ia32\binding.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\win-ia32\binding.dll,#1
2⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 596
3⤵
- Program crash
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 688
3⤵
- Program crash
PID:5028