9fe890f4a1393ef301e24b02ab3c173f230ad7a982808ce6daf130c861422208

Analysis

Score

N/A

Drops Office document 2 IoCs

dropper exploiter maldoc

Processes:

WINWORD.EXE

at	description	ioc	process
4602	File created	C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	WINWORD.EXE
5554	File created	C:\Users\Admin\AppData\Local\Temp\~$cs_caa116070d1f2f48f3a9964e695226cc.36.docx	WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_caa116070d1f2f48f3a9964e695226cc.36.docx"
1⤵
- Drops Office document
PID:772