Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2023, 03:13

General

  • Target

    sticker_bowling.xml

  • Size

    1KB

  • MD5

    8b71c5cc6c8f498dec2c99a06f871daa

  • SHA1

    aab17dc4cad3fbcf51afe00721597347b3d1bb7a

  • SHA256

    c83e1c0b05445bb361acf923c7d2270a4cb549ccfbfe2b644a797f727356ff58

  • SHA512

    48745c857f9d4b08d621fa9c078bc337023e1d38e7d6b5331f4f940dbb6f6640a6e00057ff5b07cd7ba8d164cf99cca773e40b084464ce9ed9c7f26996178ad8

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\sticker_bowling.xml"
    1⤵
      PID:4904
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4904 -s 448
        2⤵
        • Program crash
        PID:3056
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 4904 -ip 4904
      1⤵
        PID:4792

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4904-134-0x00007FFDC77F0000-0x00007FFDC79E5000-memory.dmp

        Filesize

        2.0MB

      • memory/4904-133-0x00007FFD87870000-0x00007FFD87880000-memory.dmp

        Filesize

        64KB

      • memory/4904-135-0x00007FFDC77F0000-0x00007FFDC79E5000-memory.dmp

        Filesize

        2.0MB

      • memory/4904-136-0x00007FFDC5400000-0x00007FFDC56C9000-memory.dmp

        Filesize

        2.8MB

      • memory/4904-137-0x00007FFD87870000-0x00007FFD87880000-memory.dmp

        Filesize

        64KB

      • memory/4904-138-0x00007FFDC77F0000-0x00007FFDC79E5000-memory.dmp

        Filesize

        2.0MB