1d298c323e5103aa4872d5b31f84db2e91dd13c6d3378813d222cdcf98bfb05a

Analysis

Target

contratto di propriet.07.20.doc
Size

147KB
MD5

2cf9a57324fd4fe06e23a155dea5a2db
SHA1

47acf7215247e7c2e9f75e4f30918d0758bee906
SHA256

1d298c323e5103aa4872d5b31f84db2e91dd13c6d3378813d222cdcf98bfb05a
SHA512

4217c135854131f7cfe6974fa62559dae2c75b76e3423ec118628abe51248b3e267a4852cdeee7790e68fc82871e00efc1b471db3fb734cdf1e59f1dc9d1cb1c

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1232 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1260	1232	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1232 wrote to memory of 1260	1232	WINWORD.EXE	regsvr32.exe
PID 1232 wrote to memory of 1260	1232	WINWORD.EXE	regsvr32.exe
PID 1232 wrote to memory of 1260	1232	WINWORD.EXE	regsvr32.exe
PID 1232 wrote to memory of 1260	1232	WINWORD.EXE	regsvr32.exe
PID 1232 wrote to memory of 1260	1232	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1260 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1260	regsvr32.exe