0bf73ff0ac2e81d23a005b08f8670249528170bfbb249e38a5af809c6a56c7f5

Analysis

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	4004	WerFault.exe	80

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\free-text-comment.xml"
1⤵
PID:4004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4004 -s 448
  2⤵
  - Program crash
  PID:1668

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 4004 -ip 4004
1⤵
PID:2128

memory/4004-0-0x00007FFA199B0000-0x00007FFA199C0000-memory.dmp

Filesize
64KB

Download
memory/4004-1-0x00007FFA59930000-0x00007FFA59B25000-memory.dmp

Filesize
2.0MB

Download
memory/4004-2-0x00007FFA59930000-0x00007FFA59B25000-memory.dmp

Filesize
2.0MB

Download
memory/4004-3-0x00007FFA576B0000-0x00007FFA57979000-memory.dmp

Filesize
2.8MB

Download
memory/4004-4-0x00007FFA199B0000-0x00007FFA199C0000-memory.dmp

Filesize
64KB

Download
memory/4004-5-0x00007FFA59930000-0x00007FFA59B25000-memory.dmp

Filesize
2.0MB

Download