b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2023 20:32

Target

callout_shape_4.xml
Size

1KB
MD5

828a7ba18fb29733210cccea82833faf
SHA1

0eab9f3bb7bb221a0d54a0da3379edfa80a713ed
SHA256

fad97a809483b5b59a783e811aea993048047ae6efee1f861233a63067b7a815
SHA512

ee5fea4dce25d0bc8ea471641e4bfaa3da2305b9be2c494ae8f444e44c65494764180b5412fa7192198280b2aff420c2a76eda41f036ee87a9eb246d2a067944

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1104 5040 WerFault.exe MSOXMLED.EXE

pid	pid_target	process	target process
1104	5040	WerFault.exe	MSOXMLED.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\callout_shape_4.xml"
1⤵
PID:5040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5040 -s 448
2⤵
- Program crash
PID:1104

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 5040 -ip 5040
1⤵
PID:748

memory/5040-134-0x00007FFD70190000-0x00007FFD70385000-memory.dmp

Filesize
2.0MB

Download
memory/5040-133-0x00007FFD30210000-0x00007FFD30220000-memory.dmp

Filesize
64KB

Download
memory/5040-135-0x00007FFD70190000-0x00007FFD70385000-memory.dmp

Filesize
2.0MB

Download
memory/5040-136-0x00007FFD6D9A0000-0x00007FFD6DC69000-memory.dmp

Filesize
2.8MB

Download
memory/5040-137-0x00007FFD30210000-0x00007FFD30220000-memory.dmp

Filesize
64KB

Download
memory/5040-138-0x00007FFD70190000-0x00007FFD70385000-memory.dmp

Filesize
2.0MB

Download