e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864

Resubmissions

28-03-2024 09:19

28-03-2024 09:13

max time kernel
60s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 09:13

Target

resources/app.asar.unpacked/node_modules/@termius/registry-js/win-ia32/registry.dll
Size

514KB
MD5

9d073e89aec8d130b48a9c89310cf0ef
SHA1

3ef3313c01e9b15580bcb6801bc46192610fd771
SHA256

3c18490a5309077f1bdebd5d4fef4c7c9b0115e26506b5a05273a0ebff5c3dbe
SHA512

b9582bfebc59ce2cadf85be722a06c5fbf69a0859b9506cf01393c8c264cd6d2d563f6f302a47396c88bf87179c30c7460076f742a5b09016905f5b7722e049e
SSDEEP

6144:VuhFdOG52WOfy15LEG8ELzt47EVLbtkuQInJ7wQ:4tx2x615LGELouQI/

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2448	3488	WerFault.exe	91
1348	3488	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3488	1140	rundll32.exe	91
PID 1140 wrote to memory of 3488	1140	rundll32.exe	91
PID 1140 wrote to memory of 3488	1140	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\registry-js\win-ia32\registry.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\registry-js\win-ia32\registry.dll,#1
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 568
    3⤵
    - Program crash
    PID:2448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 804
    3⤵
    - Program crash
    PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 3488
1⤵
PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3488 -ip 3488
1⤵
PID:3956