e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864

Resubmissions

28-03-2024 09:19

28-03-2024 09:13

max time kernel
60s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 09:13

Target

resources/app.asar.unpacked/node_modules/@termius/serialport-bindings/win-ia32/bindings.dll
Size

562KB
MD5

7218d39726bf53fd3257f016f9797994
SHA1

e6e442d8f3d379370653c1e2cb92584282e1ace2
SHA256

4a2952c98d2d9365b320e9d8ae288f32281ae8d3081d26efcc8a436ba860e5a0
SHA512

87f862867c0fad25c5dbaef006de9f5cd4b3a7d14874a2db470984fde783d73c7bfd5d96a709fa02449c415013def853721faf116228f53cebcea76e88555c8d
SSDEEP

6144:Akzv/ZIPdk4AUZXFGwXCgAUxd1pgRA2BFT2UUfud09bxOueyJKr:vzv/ZIPd6YFGwXCgbXcSud0tMTyJU

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1512	1288	WerFault.exe	86
4316	1288	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 1288	32	rundll32.exe	86
PID 32 wrote to memory of 1288	32	rundll32.exe	86
PID 32 wrote to memory of 1288	32	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\win-ia32\bindings.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\serialport-bindings\win-ia32\bindings.dll,#1
  2⤵
  PID:1288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 580
    3⤵
    - Program crash
    PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 792
    3⤵
    - Program crash
    PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1288 -ip 1288
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1288 -ip 1288
1⤵
PID:3964