ccf950c9869d1bf9882478bb2a8bbf9b65c21eb0e0c8d851c4bdda3232b40c11

Analysis

Target

figure.07.08.20.doc
Size

134KB
MD5

d830dff1af4844d03914d53c388902a6
SHA1

d67e8ab969d141a527238cd6a369f90b0136d92d
SHA256

ccf950c9869d1bf9882478bb2a8bbf9b65c21eb0e0c8d851c4bdda3232b40c11
SHA512

ae6e0940b36883f94ec03746d22b596a0e4d3121f0adbf9c620b287aa2d8049dda49a3a82781a6ae0a434d2d1d52e2d4ef35fbe9012e407a570ec8c167f374b9

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1112	1124	regsvr32.exe	23

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1112	1124	WINWORD.EXE	26
PID 1124 wrote to memory of 1112	1124	WINWORD.EXE	26
PID 1124 wrote to memory of 1112	1124	WINWORD.EXE	26
PID 1124 wrote to memory of 1112	1124	WINWORD.EXE	26
PID 1124 wrote to memory of 1112	1124	WINWORD.EXE	26

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1112	regsvr32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1124	WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

memory/1124-4-0x0000000007050000-0x0000000007250000-memory.dmp

Filesize
2.0MB

Download