Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/05/2024, 17:43
240523-waxw8sag81 1007/05/2024, 14:30
240507-rvdlwabb6s 1025/03/2024, 12:06
240325-n94j3aaa9v 10Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 17:43
Behavioral task
behavioral1
Sample
resources/app.asar.unpacked/node_modules/@termius/libtermius/win-ia32/libssh2.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
resources/app.asar.unpacked/node_modules/@termius/libtermius/win-ia32/libssh2.dll
Resource
win10v2004-20240426-en
General
-
Target
resources/app.asar.unpacked/node_modules/@termius/libtermius/win-ia32/libssh2.dll
-
Size
2.9MB
-
MD5
72d37e2ae392e6121c78fb095482db96
-
SHA1
a7ffd6d030b654011f46f0afab77c88de2a88fe5
-
SHA256
f6f93ce6a528ca62091898c0d6d76f5fd7158f1d23edfa7c7da07020b1175471
-
SHA512
c585c2010f68f18d2bec3adafc07bf1b5d443cb8e9a673422777c1e77058b22061cdfa2dc63661ca246421716e9750dcb364ce1e44aa10060d5aaaede1bd828d
-
SSDEEP
24576:GvNIzkQBpi+KpPQED3mUJVp5vBPobNJgJoqY3bBl0RFHRAHDdT4ajk6cIQikpjf1:GUbutD3L7KsFWjinjfDsEtvpp/TxTPP
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 512 1684 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2496 wrote to memory of 1684 2496 rundll32.exe 85 PID 2496 wrote to memory of 1684 2496 rundll32.exe 85 PID 2496 wrote to memory of 1684 2496 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libtermius\win-ia32\libssh2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\@termius\libtermius\win-ia32\libssh2.dll,#12⤵PID:1684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 6283⤵
- Program crash
PID:512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1684 -ip 16841⤵PID:672