e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864

Resubmissions

28-03-2024 09:19

28-03-2024 09:13

max time kernel
60s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 09:13

Target

resources/app.asar.unpacked/node_modules/@termius/windows-iap-bridge/win-ia32/binding.dll
Size

706KB
MD5

d0bed07d11ea06d6bf4ac0baa228c4de
SHA1

33f3c3bb0f2789981c5297dba66505dc008605fb
SHA256

c1b244c395c03d29774593d7d9fa7183a9bf06f06970e7d06243ad5b74e38880
SHA512

3da2e1b7171f4a9a60e9871eb5a5b53b0f690c139d9f9ab771ea06e20a207981497c078cf44184369b9ea71abae17fa77bc7c0045c5bb6846c7e4a978e59fdfd
SSDEEP

6144:i0Rs4zCbge4GzRElPAuZU6ON2NKeUPXcyoq2Z6DBwJYfZrmVKuDsutn9Ulda9qLZ:i0DGOJAuZUXNX/cyoq2Z6DsIuDsudCZ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4688	2668	WerFault.exe	94
1676	2668	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 2668	1012	rundll32.exe	94
PID 1012 wrote to memory of 2668	1012	rundll32.exe	94
PID 1012 wrote to memory of 2668	1012	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\win-ia32\binding.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\windows-iap-bridge\win-ia32\binding.dll,#1
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 560
    3⤵
    - Program crash
    PID:4688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 796
    3⤵
    - Program crash
    PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2668 -ip 2668
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2668 -ip 2668
1⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4196 --field-trial-handle=2252,i,3429015581403167983,2708022432612919502,262144 --variations-seed-version /prefetch:8
1⤵
PID:3320