f9b682245ad0fe442e1bbe331f67b8c6a6241aac9fb2aa727b020a4f0a897ce2

Analysis

Target

file 07.08.2020.doc
Size

147KB
MD5

f87de9e54541c53de616b230852e0d28
SHA1

9cf0153c3a04a30c138ab649b8a8cb1286c8fd8a
SHA256

f9b682245ad0fe442e1bbe331f67b8c6a6241aac9fb2aa727b020a4f0a897ce2
SHA512

5652193e9c969fb3150a8e8c2291f8b964f83ef1e3868df579666273b3abb7f56264993ee259a59e866d38f663f158dc9bd1fc046b377abf8bd8b5fe098e99b5

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1108 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1092	1108	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1108 wrote to memory of 1092	1108	WINWORD.EXE	regsvr32.exe
PID 1108 wrote to memory of 1092	1108	WINWORD.EXE	regsvr32.exe
PID 1108 wrote to memory of 1092	1108	WINWORD.EXE	regsvr32.exe
PID 1108 wrote to memory of 1092	1108	WINWORD.EXE	regsvr32.exe
PID 1108 wrote to memory of 1092	1108	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1092 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1092	regsvr32.exe