859ee5d6161bb723f736f9ce868a3ab5a4cd5b4c07296239d0fcc49d7cdd8249

Analysis

Reason

Machine shutdown

Target

certificato-07.08.2020.doc
Size

147KB
MD5

e6524bfe307ac0e25cbefd32e562f7b5
SHA1

c82af405405cc21144e12c943a36ee785393c1b8
SHA256

859ee5d6161bb723f736f9ce868a3ab5a4cd5b4c07296239d0fcc49d7cdd8249
SHA512

31f0858a420c126e1011197ac54b847d2ba84845cf91ef7f0965271f4ddd78004674722d68ad3a34b3a398ffd4d4bbb52761140d473a622a83d5e69664d6506b

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1068 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1100	1068	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe
PID 1068 wrote to memory of 1100	1068	WINWORD.EXE	regsvr32.exe

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" Qo.tmp
2⤵
- Process spawned unexpected child process
PID:1100