Analysis

  • max time kernel
    90s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2023, 04:53

General

  • Target

    adlcp_rootv1p2.xml

  • Size

    4KB

  • MD5

    e2d3872c7509f6e3f1fc7ab7c07eee52

  • SHA1

    cd9e790f4d508f2fe060afc7d001a337b0b14efb

  • SHA256

    166397a1f52585caac857228cf2b10085a5d07c0612a3d55cb3ed108ce8b028a

  • SHA512

    c4d50965ed38104ac8a391ff84459991d1c7536d89d8e9afb1eea9fe15528dd369ce973c7d3db48fc89a9f0b3af44bad4926a20a60245fcf5fb881819b1875ce

  • SSDEEP

    48:KE36pp/8pjcDEdXYr6WO3fWAwRxYTXPD3ZM06uOvOfkOefOOCTu0mY:r3U/i1iQXwzITmiwu/b

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\adlcp_rootv1p2.xml"
    1⤵
      PID:576
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 576 -s 444
        2⤵
        • Program crash
        PID:4740
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 404 -p 576 -ip 576
      1⤵
        PID:3812

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/576-0-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

        Filesize

        64KB

      • memory/576-1-0x00007FFF34710000-0x00007FFF34905000-memory.dmp

        Filesize

        2.0MB

      • memory/576-2-0x00007FFF34710000-0x00007FFF34905000-memory.dmp

        Filesize

        2.0MB

      • memory/576-3-0x00007FFF31E30000-0x00007FFF320F9000-memory.dmp

        Filesize

        2.8MB

      • memory/576-4-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

        Filesize

        64KB

      • memory/576-5-0x00007FFF34710000-0x00007FFF34905000-memory.dmp

        Filesize

        2.0MB