e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864

Resubmissions

28-03-2024 09:19

28-03-2024 09:13

max time kernel
60s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 09:13

Target

resources/app.asar.unpacked/node_modules/@termius/registry-js/win-ia32/registry.dll
Size

514KB
MD5

9d073e89aec8d130b48a9c89310cf0ef
SHA1

3ef3313c01e9b15580bcb6801bc46192610fd771
SHA256

3c18490a5309077f1bdebd5d4fef4c7c9b0115e26506b5a05273a0ebff5c3dbe
SHA512

b9582bfebc59ce2cadf85be722a06c5fbf69a0859b9506cf01393c8c264cd6d2d563f6f302a47396c88bf87179c30c7460076f742a5b09016905f5b7722e049e
SSDEEP

6144:VuhFdOG52WOfy15LEG8ELzt47EVLbtkuQInJ7wQ:4tx2x615LGELouQI/

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2448 3488 WerFault.exe rundll32.exe
1348 3488 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2448	3488	WerFault.exe	rundll32.exe
1348	3488	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1140 wrote to memory of 3488	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 3488	1140	rundll32.exe	rundll32.exe
PID 1140 wrote to memory of 3488	1140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\registry-js\win-ia32\registry.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\registry-js\win-ia32\registry.dll,#1
2⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 568
3⤵
- Program crash
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 804
3⤵
- Program crash
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 3488
1⤵
PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3488 -ip 3488
1⤵
PID:3956