2321d68dd852f459bb95ab10c6517516d574578d3f184ea83d85a7b83123ab09

Analysis

Target

2321d68dd852f459bb95ab10c6517516d574578d3f184ea83d85a7b83123ab09.doc
Size

147KB
MD5

4e16d9ee583f8fb7acbd8111608038b0
SHA1

dd0c3748e86b579450d462e3fff370b140bc9af8
SHA256

2321d68dd852f459bb95ab10c6517516d574578d3f184ea83d85a7b83123ab09
SHA512

d46d59a6f4150cba502e606f4c65c1e6333e496dc81d5f761a804fb60d3895ac5c0d2d0b43962d3f287dea0b565ec1a1ff097520b969f103c3a531eab657762d

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1044 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	532	1044	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1044 wrote to memory of 532	1044	WINWORD.EXE	regsvr32.exe
PID 1044 wrote to memory of 532	1044	WINWORD.EXE	regsvr32.exe
PID 1044 wrote to memory of 532	1044	WINWORD.EXE	regsvr32.exe
PID 1044 wrote to memory of 532	1044	WINWORD.EXE	regsvr32.exe
PID 1044 wrote to memory of 532	1044	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

532 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
532	regsvr32.exe