2f9428fcf12b9d8a677d433062ebc720e6ae7685a36184aef06b91e55833c890

Analysis

max time kernel
133s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2023 01:18

Target

rev_3286/AppXRuntime.xml
Size

3KB
MD5

88d794ea092ef395433cfa321d06e5e4
SHA1

f1f7c7dfbd04ac5a92cbde88bd4f087781d63c40
SHA256

5afc969e4212a6511f307385c99b8868e8c873183dc271bbb95ba571b24eb53e
SHA512

ebb770102b8202de4bb7319cbc2cda860e4de5d1e95f0fbef4d4890aa2b22cd48cf73909d028a37b507926b4fad573716fba16e50b8f9eca8d5feab00ac17cca

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3752	1696	WerFault.exe	60

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\rev_3286\AppXRuntime.xml"
1⤵
PID:1696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1696 -s 448
  2⤵
  - Program crash
  PID:3752

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1696 -ip 1696
1⤵
PID:5044

memory/1696-133-0x00007FFF93730000-0x00007FFF93740000-memory.dmp

Filesize
64KB

Download
memory/1696-134-0x00007FFFD36B0000-0x00007FFFD38A5000-memory.dmp

Filesize
2.0MB

Download
memory/1696-135-0x00007FFFD36B0000-0x00007FFFD38A5000-memory.dmp

Filesize
2.0MB

Download
memory/1696-136-0x00007FFFD36B0000-0x00007FFFD38A5000-memory.dmp

Filesize
2.0MB

Download
memory/1696-137-0x00007FFFD0DD0000-0x00007FFFD1099000-memory.dmp

Filesize
2.8MB

Download
memory/1696-138-0x00007FFF93730000-0x00007FFF93740000-memory.dmp

Filesize
64KB

Download
memory/1696-139-0x00007FFFD36B0000-0x00007FFFD38A5000-memory.dmp

Filesize
2.0MB

Download