e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 11:44

Target

resources/app.asar.unpacked/node_modules/@termius/libfido2/win-ia32/cbor.dll
Size

180KB
MD5

e004b0df1216acd143851c4b69b7dea3
SHA1

aa4b8f9d4f29b19e521a0c766714c02e0e3d70ed
SHA256

db32c80110d514e6c4357d201107a9277c2269b05aadb6a451df6fcf6b611377
SHA512

2d8eba626452b1c3f14a57db72bf66f546bfffc6ff92c7b05ec22b0082c9cf3439c991c026d4ed417835818e11b95bb408a69f20f9676d3f5afd9374f725df94
SSDEEP

3072:5fzKUbDcqIfV4E54DIPQePucoINTpuqc2lv9HGjCv+GcAgnXl61x8aZTTVAopszI:5K9GjNWUXkyaZTppeiexh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	2160	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2160	3056	rundll32.exe	28
PID 3056 wrote to memory of 2160	3056	rundll32.exe	28
PID 3056 wrote to memory of 2160	3056	rundll32.exe	28
PID 3056 wrote to memory of 2160	3056	rundll32.exe	28
PID 3056 wrote to memory of 2160	3056	rundll32.exe	28
PID 3056 wrote to memory of 2160	3056	rundll32.exe	28
PID 3056 wrote to memory of 2160	3056	rundll32.exe	28
PID 2160 wrote to memory of 1808	2160	rundll32.exe	29
PID 2160 wrote to memory of 1808	2160	rundll32.exe	29
PID 2160 wrote to memory of 1808	2160	rundll32.exe	29
PID 2160 wrote to memory of 1808	2160	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\cbor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libfido2\win-ia32\cbor.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 220
    3⤵
    - Program crash
    PID:1808