c9f867afbf23760e2dcf9582ec762c18ba458e98b1ac5efc8f69d6785d45d932

Analysis

Target

statistica 07.08.2020.doc
Size

133KB
MD5

424ca9eba9300706fec87e0705d5e53c
SHA1

0bed3bd81d21445d7d2efa65a9aa3149decfcfed
SHA256

c9f867afbf23760e2dcf9582ec762c18ba458e98b1ac5efc8f69d6785d45d932
SHA512

bd40ce16cbfc37d36a25b24150dce7f4e070b2931afabddaea7b17944cbcbdeffd44732805963cb7bd0ab14c4b026dad98e8de670238aa59d052e364277f9502

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1064 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1088	1064	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1064 wrote to memory of 1088	1064	WINWORD.EXE	regsvr32.exe
PID 1064 wrote to memory of 1088	1064	WINWORD.EXE	regsvr32.exe
PID 1064 wrote to memory of 1088	1064	WINWORD.EXE	regsvr32.exe
PID 1064 wrote to memory of 1088	1064	WINWORD.EXE	regsvr32.exe
PID 1064 wrote to memory of 1088	1064	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1088 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1088	regsvr32.exe