dcfb8f77847d724370d6688b004e2dc005ca02fc1c9f5665896d43f546174620

Analysis

Target

certificato_07.08.2020.doc
Size

134KB
MD5

212e1d537b4335f22f19efd8255f0e45
SHA1

a399e390cc926727ee79eff1893ca317ca379cbd
SHA256

dcfb8f77847d724370d6688b004e2dc005ca02fc1c9f5665896d43f546174620
SHA512

7824d67e4c09cff9157db5eeaa8309da3c38941fac5e191d4f27ce618bf4280929576251ee46617c3966e7875cc1ff13366f18198e34a787cb02a172f8b4945d

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1044 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1076	1044	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1044 wrote to memory of 1076	1044	WINWORD.EXE	regsvr32.exe
PID 1044 wrote to memory of 1076	1044	WINWORD.EXE	regsvr32.exe
PID 1044 wrote to memory of 1076	1044	WINWORD.EXE	regsvr32.exe
PID 1044 wrote to memory of 1076	1044	WINWORD.EXE	regsvr32.exe
PID 1044 wrote to memory of 1076	1044	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1076 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1076	regsvr32.exe