a76aa17b3c66f1bc861ff329710e0b94c0a9fdefa9e3c1b3e6d1d8410d85b679

Analysis

Target

file_07.20.doc
Size

147KB
MD5

2908546ca31c2afbb20b6fbdde284b25
SHA1

fb5a6054c9f66ad4c5d16e20f8aee2cca0ef98d5
SHA256

a76aa17b3c66f1bc861ff329710e0b94c0a9fdefa9e3c1b3e6d1d8410d85b679
SHA512

608a411379a00acdd3909faa68aa6c2c47739698e15bc811621dae41b09e26b42061d5ca8752958e4d03f59bd0359b78a1edb672675fa98ba45814d7fb972c7b

Score

10^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1072 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1668	1072	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1072 wrote to memory of 1668	1072	WINWORD.EXE	regsvr32.exe
PID 1072 wrote to memory of 1668	1072	WINWORD.EXE	regsvr32.exe
PID 1072 wrote to memory of 1668	1072	WINWORD.EXE	regsvr32.exe
PID 1072 wrote to memory of 1668	1072	WINWORD.EXE	regsvr32.exe
PID 1072 wrote to memory of 1668	1072	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1668 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1668	regsvr32.exe