6009d4b5fa09ca6115a5e3f3d393dde2d7d11e08b9ea72b04654df23817004d4

Analysis

Target

inchiesta.07.20.doc
Size

134KB
MD5

57227f5d6d7ae3551ccbb22639201fc6
SHA1

ca1ead5a10dd55248dfae699c96dde8909210e64
SHA256

6009d4b5fa09ca6115a5e3f3d393dde2d7d11e08b9ea72b04654df23817004d4
SHA512

6fea07aef9a7b6bc078b01cbb22032d7ec9b9c8822644367fb05a7070f40dd460e9b8e37ba65fcfe29167df6f1008a9048fb5a556fc1c9f7e84db53afb179b27

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1956	1688	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1688 wrote to memory of 1956	1688	WINWORD.EXE	regsvr32.exe
PID 1688 wrote to memory of 1956	1688	WINWORD.EXE	regsvr32.exe
PID 1688 wrote to memory of 1956	1688	WINWORD.EXE	regsvr32.exe
PID 1688 wrote to memory of 1956	1688	WINWORD.EXE	regsvr32.exe
PID 1688 wrote to memory of 1956	1688	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1956 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1688 WINWORD.EXE

pid	process
1956	regsvr32.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE