85bb51f967c687aab67713bc5bd3d15e272c71fe21215957c61a2531c94c192a

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 21:42

Target

Microsoft.win32.prefetch.exe
Size

388KB
MD5

bc7dff0196b4977afea8aa5338a4edac
SHA1

4965beff7ffaaf27aeab2d46cfeb9ab096882055
SHA256

85bb51f967c687aab67713bc5bd3d15e272c71fe21215957c61a2531c94c192a
SHA512

f256cebb047ed9671274b3c6f03e7021fa56c35e6c9e95dbb8cb4988600c349385abfc95247ab1701bec1fc455287f259049b29a69edda9aa2837cd786c4f725
SSDEEP

12288:plkz6SGkQm3HvxhOW+537tz/D+KYKNUXC9:paz6SGkQm3lCLN/i7XXC

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3232	4552	WerFault.exe	84
4012	4552	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3232	4552	Microsoft.win32.prefetch.exe	89
PID 4552 wrote to memory of 3232	4552	Microsoft.win32.prefetch.exe	89
PID 4552 wrote to memory of 3232	4552	Microsoft.win32.prefetch.exe	89

C:\Users\Admin\AppData\Local\Temp\Microsoft.win32.prefetch.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft.win32.prefetch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 896
  2⤵
  - Program crash
  PID:3232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 896
  2⤵
  - Program crash
  PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4552 -ip 4552
1⤵
PID:1992

memory/4552-1-0x0000000000C00000-0x0000000000C68000-memory.dmp

Filesize
416KB

Download
memory/4552-0-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4552-2-0x0000000005670000-0x0000000005680000-memory.dmp

Filesize
64KB

Download
memory/4552-3-0x0000000005680000-0x0000000005768000-memory.dmp

Filesize
928KB

Download
memory/4552-4-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/4552-5-0x0000000005670000-0x0000000005680000-memory.dmp

Filesize
64KB

Download
memory/4552-6-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download