d2b3bff49d5381ae41e4903277538591b7ce9df1e932d3069a32f4a78ac0816f

Analysis

Target

d2b3bff49d5381ae41e4903277538591b7ce9df1e932d3069a32f4a78ac0816f.doc
Size

132KB
MD5

30b85636bb4e9be61434d701cc1c4809
SHA1

e647332abb5d9e2c3ae077937cfe07a7b7f86b9a
SHA256

d2b3bff49d5381ae41e4903277538591b7ce9df1e932d3069a32f4a78ac0816f
SHA512

d4cbaa19ab96fda11924d5880fc08bea21aefe60d72bb1e10fa9398c6b51d28a2203d5c2e636e6b07f4742609b01afccf77c5a732b4090e04eba6ccd3892bae1

Score

10^/10

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1068	832	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 832 wrote to memory of 1068	832	WINWORD.EXE	regsvr32.exe
PID 832 wrote to memory of 1068	832	WINWORD.EXE	regsvr32.exe
PID 832 wrote to memory of 1068	832	WINWORD.EXE	regsvr32.exe
PID 832 wrote to memory of 1068	832	WINWORD.EXE	regsvr32.exe
PID 832 wrote to memory of 1068	832	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1068 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

832 WINWORD.EXE

pid	process
1068	regsvr32.exe

\??\c:\programdata\22510.jpg

Download Submit
memory/832-0-0x0000000006C70000-0x0000000006CD5000-memory.dmp

Filesize
404KB

Download
memory/1068-4-0x0000000000000000-mapping.dmp

Download