b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e

Analysis

max time kernel
140s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2023 20:32

Target

callout_shape_5.xml
Size

3KB
MD5

3b6eb1ca75da44d8df15f66358aa7ed2
SHA1

6e43efdc6bb028ca022a2bc8bb005ad4f52f0d08
SHA256

dbac2601ec9c8909b1af9992c835313f62d2f6f8226e3e142136c8e3fa793f0a
SHA512

08f6e115d5b32e7d6c305be446f4ca9f803031486c6816a50ee981ab68f0d588247dc22f8048881e2319fcad2c935d1fcb2c25560a8a79a5500a97bf68963970

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4844 1804 WerFault.exe MSOXMLED.EXE

pid	pid_target	process	target process
4844	1804	WerFault.exe	MSOXMLED.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\callout_shape_5.xml"
1⤵
PID:1804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1804 -s 448
  2⤵
  - Program crash
  PID:4844

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1804 -ip 1804
1⤵
PID:4792

memory/1804-134-0x00007FFB726F0000-0x00007FFB728E5000-memory.dmp

Filesize
2.0MB

Download
memory/1804-133-0x00007FFB32770000-0x00007FFB32780000-memory.dmp

Filesize
64KB

Download
memory/1804-136-0x00007FFB726F0000-0x00007FFB728E5000-memory.dmp

Filesize
2.0MB

Download
memory/1804-135-0x00007FFB726F0000-0x00007FFB728E5000-memory.dmp

Filesize
2.0MB

Download
memory/1804-137-0x00007FFB70250000-0x00007FFB70519000-memory.dmp

Filesize
2.8MB

Download
memory/1804-138-0x00007FFB32770000-0x00007FFB32780000-memory.dmp

Filesize
64KB

Download
memory/1804-139-0x00007FFB726F0000-0x00007FFB728E5000-memory.dmp

Filesize
2.0MB

Download