332231ca3fb405b7621611bd22e7016cc73c32d90318753424ca598833775d76

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2023 22:08

Target

bird.xml
Size

1KB
MD5

564073fb36287299158db87208c3ef4b
SHA1

d9ea8d3bbeee99b3acdc1fbd5f779d329783852c
SHA256

888e1f6b188d57d2bb5c86656872193e2dc882672c67ac53a1c6828ee95f40b2
SHA512

77ad8ceaa1784c765eb3ac3cd2d8da442d5bcaa8086e67de4baa929d020ffd90895fe61710f285d6668235188b9520203b86c986154815cf5de82b29c4b3ef1f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2364 4028 WerFault.exe MSOXMLED.EXE

pid	pid_target	process	target process
2364	4028	WerFault.exe	MSOXMLED.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\bird.xml"
1⤵
PID:4028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4028 -s 472
  2⤵
  - Program crash
  PID:2364

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4028 -ip 4028
1⤵
PID:5044

memory/4028-133-0x00007FF91D2B0000-0x00007FF91D2C0000-memory.dmp

Filesize
64KB

Download
memory/4028-134-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4028-135-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4028-136-0x00007FF95AD40000-0x00007FF95B009000-memory.dmp

Filesize
2.8MB

Download
memory/4028-137-0x00007FF91D2B0000-0x00007FF91D2C0000-memory.dmp

Filesize
64KB

Download
memory/4028-138-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download