4bd7d4ccfd5c2935b6bd7b6fad313f73f69d5a05101ea97747e59a21f463781e

Resubmissions

23-05-2024 17:43

07-05-2024 14:30

25-03-2024 12:06

max time kernel
122s
max time network
146s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 12:06

Target

resources/app.asar.unpacked/node_modules/@termius/windows-iap-bridge/win-ia32/binding.dll
Size

706KB
MD5

d0bed07d11ea06d6bf4ac0baa228c4de
SHA1

33f3c3bb0f2789981c5297dba66505dc008605fb
SHA256

c1b244c395c03d29774593d7d9fa7183a9bf06f06970e7d06243ad5b74e38880
SHA512

3da2e1b7171f4a9a60e9871eb5a5b53b0f690c139d9f9ab771ea06e20a207981497c078cf44184369b9ea71abae17fa77bc7c0045c5bb6846c7e4a978e59fdfd
SSDEEP

6144:i0Rs4zCbge4GzRElPAuZU6ON2NKeUPXcyoq2Z6DBwJYfZrmVKuDsutn9Ulda9qLZ:i0DGOJAuZUXNX/cyoq2Z6DsIuDsudCZ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3060	1520	WerFault.exe	72
5028	1520	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 1520	4708	rundll32.exe	72
PID 4708 wrote to memory of 1520	4708	rundll32.exe	72
PID 4708 wrote to memory of 1520	4708	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\win-ia32\binding.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\win-ia32\binding.dll,#1
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 596
    3⤵
    - Program crash
    PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 688
    3⤵
    - Program crash
    PID:5028