fd72038524f82d299b58d0b9de0da0cfa10f19eb746ed863fec62345b1044f51

Analysis

max time kernel
138s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2023 22:05

Target

bird.xml
Size

1KB
MD5

564073fb36287299158db87208c3ef4b
SHA1

d9ea8d3bbeee99b3acdc1fbd5f779d329783852c
SHA256

888e1f6b188d57d2bb5c86656872193e2dc882672c67ac53a1c6828ee95f40b2
SHA512

77ad8ceaa1784c765eb3ac3cd2d8da442d5bcaa8086e67de4baa929d020ffd90895fe61710f285d6668235188b9520203b86c986154815cf5de82b29c4b3ef1f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4296 2380 WerFault.exe MSOXMLED.EXE

pid	pid_target	process	target process
4296	2380	WerFault.exe	MSOXMLED.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\bird.xml"
1⤵
PID:2380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2380 -s 448
  2⤵
  - Program crash
  PID:4296

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 2380 -ip 2380
1⤵
PID:2412

memory/2380-0-0x00007FFE134D0000-0x00007FFE134E0000-memory.dmp

Filesize
64KB

Download
memory/2380-1-0x00007FFE53450000-0x00007FFE53645000-memory.dmp

Filesize
2.0MB

Download
memory/2380-2-0x00007FFE53450000-0x00007FFE53645000-memory.dmp

Filesize
2.0MB

Download
memory/2380-3-0x00007FFE50DD0000-0x00007FFE51099000-memory.dmp

Filesize
2.8MB

Download
memory/2380-4-0x00007FFE134D0000-0x00007FFE134E0000-memory.dmp

Filesize
64KB

Download
memory/2380-5-0x00007FFE53450000-0x00007FFE53645000-memory.dmp

Filesize
2.0MB

Download