Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2023 22:00

General

  • Target

    Ln_sub.xml

  • Size

    906B

  • MD5

    50948f090a36b025ceeadb20cfedf70c

  • SHA1

    5d1222847e797a649d2a1115f09522004388cb5c

  • SHA256

    fe98593b9944c672753c1e1404bf2d8edba24474c189d4c229bbb94219259565

  • SHA512

    a6deec560f44944b6e2ce14254edb23f127fd413873e68f7ab3c238653ae7395ec44f96dab61ba75a2e8eb841693b10c86b7ba9829d97890140958edef5f8272

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Ln_sub.xml"
    1⤵
      PID:2664
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2664 -s 436
        2⤵
        • Program crash
        PID:732
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 2664 -ip 2664
      1⤵
        PID:2544

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2664-133-0x00007FFE91770000-0x00007FFE91780000-memory.dmp

        Filesize

        64KB

      • memory/2664-134-0x00007FFED16F0000-0x00007FFED18E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2664-135-0x00007FFED16F0000-0x00007FFED18E5000-memory.dmp

        Filesize

        2.0MB

      • memory/2664-136-0x00007FFECF420000-0x00007FFECF6E9000-memory.dmp

        Filesize

        2.8MB

      • memory/2664-137-0x00007FFE91770000-0x00007FFE91780000-memory.dmp

        Filesize

        64KB

      • memory/2664-138-0x00007FFED16F0000-0x00007FFED18E5000-memory.dmp

        Filesize

        2.0MB