6dda51e294cc343b50106676ad5708face3cfc7f16d99f69a34e4b3b85c632cc

Analysis

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	3880	WerFault.exe	24

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\free-text-comment.xml"
1⤵
PID:3880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3880 -s 448
  2⤵
  - Program crash
  PID:2552

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 3880 -ip 3880
1⤵
PID:1148

memory/3880-133-0x00007FFE49D30000-0x00007FFE49D40000-memory.dmp

Filesize
64KB

Download
memory/3880-134-0x00007FFE89CB0000-0x00007FFE89EA5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-135-0x00007FFE89CB0000-0x00007FFE89EA5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-136-0x00007FFE87430000-0x00007FFE876F9000-memory.dmp

Filesize
2.8MB

Download
memory/3880-137-0x00007FFE49D30000-0x00007FFE49D40000-memory.dmp

Filesize
64KB

Download
memory/3880-138-0x00007FFE89CB0000-0x00007FFE89EA5000-memory.dmp

Filesize
2.0MB

Download