5c0ac93c7fb221b92028be97f12702bd1f6150e9fa654f65609556ed6822fd18

Analysis

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	1640	WerFault.exe	80

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\free-text-comment.xml"
1⤵
PID:1640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1640 -s 448
  2⤵
  - Program crash
  PID:2684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1640 -ip 1640
1⤵
PID:232

memory/1640-133-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1640-134-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1640-135-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1640-136-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download
memory/1640-137-0x00007FFFA65C0000-0x00007FFFA6889000-memory.dmp

Filesize
2.8MB

Download
memory/1640-138-0x00007FFF68D70000-0x00007FFF68D80000-memory.dmp

Filesize
64KB

Download
memory/1640-139-0x00007FFFA8CF0000-0x00007FFFA8EE5000-memory.dmp

Filesize
2.0MB

Download