855c03fb9cb069d04ffc33626e3bff7a4913fd036e08d0efcbe0e17f3706aca3

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 11:29

Target

xx.ArPublicParams.xml
Size

485B
MD5

9bd82929fd635201ec8e8dbf51526335
SHA1

a8d5763be22ef40e9a6b627c74e7fd5d08eff633
SHA256

ad7dcad973fbddf5adef90bb8606b9e4369c776ac57a81d4b91d367a20714e6b
SHA512

cdeecdde9d09e6a6425b4ddffdd113fcab194ebc9153d345d012f5758d3f0545fb0986d765d36f4205665988f0d2c304a4862159256c79b8a909e1dd0fd1d15c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3520	408	WerFault.exe	56

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\xx.ArPublicParams.xml"
1⤵
PID:408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 408 -s 472
  2⤵
  - Program crash
  PID:3520

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 408 -ip 408
1⤵
PID:3020

memory/408-133-0x00007FFAC0FF0000-0x00007FFAC1000000-memory.dmp

Filesize
64KB

Download
memory/408-134-0x00007FFB00F70000-0x00007FFB01165000-memory.dmp

Filesize
2.0MB

Download
memory/408-135-0x00007FFB00F70000-0x00007FFB01165000-memory.dmp

Filesize
2.0MB

Download
memory/408-136-0x00007FFAFE7E0000-0x00007FFAFEAA9000-memory.dmp

Filesize
2.8MB

Download
memory/408-137-0x00007FFAC0FF0000-0x00007FFAC1000000-memory.dmp

Filesize
64KB

Download
memory/408-138-0x00007FFB00F70000-0x00007FFB01165000-memory.dmp

Filesize
2.0MB

Download