5ed3ae3b34dc28e9f04dbc880a62a3595f3ac6f5c8d133917f15a98b17f121fc

Analysis

Target

payment_752.xls
Size

148KB
MD5

8e27f25d7c56eb111e6e60b735562ce5
SHA1

ea8aa1d15c8c3a480ca553c9c514256d6b0a5c95
SHA256

5ed3ae3b34dc28e9f04dbc880a62a3595f3ac6f5c8d133917f15a98b17f121fc
SHA512

a4335f5f25bbbc4005f638536936280eba51e21239dada04b76edc12ab40dc3ceacf60c56cd899280fd3eb79c46761f2cd209a5b8b46c1932c00661dc9ee3cca

Score

10^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1860	1768	EXCEL.EXE	24
PID 1768 wrote to memory of 1860	1768	EXCEL.EXE	24
PID 1768 wrote to memory of 1860	1768	EXCEL.EXE	24
PID 1900 wrote to memory of 1916	1900	explorer.exe	26
PID 1900 wrote to memory of 1916	1900	explorer.exe	26
PID 1900 wrote to memory of 1916	1900	explorer.exe	26

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1768	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1860	1768	explorer.exe	23

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\payment_752.xls
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1768
- C:\Windows\explorer.exe
  explorer.exe C:\Users\Admin\AppData\Local\Temp\tZrm.vbs
  2⤵
  - Process spawned unexpected child process
  PID:1860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tZrm.vbs"
  2⤵
  PID:1916

memory/1768-5-0x0000000004510000-0x0000000004518000-memory.dmp

Filesize
32KB

Download
memory/1916-3-0x0000000002530000-0x0000000002534000-memory.dmp

Filesize
16KB

Download