b6afe64ae4567147667d6e8e1ad9a2532ea376f1e9cdeb37b1bdb64030c9ed16

Analysis

max time kernel
136s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2023 17:45

Target

billing-ce-cp/.svn/pristine/37/372924d0e561e64f1200690be39f3c797dbf95b8.xml
Size

3KB
MD5

8642914ad244f675b1bde9ef67106dbb
SHA1

372924d0e561e64f1200690be39f3c797dbf95b8
SHA256

1b1913d822e3f5c47cb0d9e6b3f9ba0bd625dae3cbba3a33f26fae31418b987a
SHA512

fa4c72386f553837d55c315211868043c7507610660ac866dd0b112646c0905ee7dab980f6f94c29e9662a9812aae3c794d5fdb405d60f4690757d6349eab03b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4740 3496 WerFault.exe MSOXMLED.EXE

pid	pid_target	process	target process
4740	3496	WerFault.exe	MSOXMLED.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\billing-ce-cp\.svn\pristine\37\372924d0e561e64f1200690be39f3c797dbf95b8.xml"
1⤵
PID:3496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3496 -s 448
2⤵
- Program crash
PID:4740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3496 -ip 3496
1⤵
PID:4524

memory/3496-133-0x00007FFFB2690000-0x00007FFFB26A0000-memory.dmp

Filesize
64KB

Download
memory/3496-134-0x00007FFFF2610000-0x00007FFFF2805000-memory.dmp

Filesize
2.0MB

Download
memory/3496-135-0x00007FFFF2610000-0x00007FFFF2805000-memory.dmp

Filesize
2.0MB

Download
memory/3496-136-0x00007FFFEFD30000-0x00007FFFEFFF9000-memory.dmp

Filesize
2.8MB

Download
memory/3496-137-0x00007FFFB2690000-0x00007FFFB26A0000-memory.dmp

Filesize
64KB

Download
memory/3496-138-0x00007FFFF2610000-0x00007FFFF2805000-memory.dmp

Filesize
2.0MB

Download