d21916b27b5efdd803201119c97e5318019fff9715a428ec3ca7ded7c86e6e4c

Analysis

Target

ordinare 07.08.2020.doc
Size

147KB
MD5

10cb72a11b08464287de4f6386aa1804
SHA1

79fd474a39128136b5d056c2e52d4d573d59a330
SHA256

d21916b27b5efdd803201119c97e5318019fff9715a428ec3ca7ded7c86e6e4c
SHA512

92febdea66347122623e346466367b23deda4c4947a590466ff6730154b2743cb1f237cf7cd4915af1e0ca0c993133cfc615c1b6c0224cd342e7e3d6b2776361

Score

10^/10

Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

616 WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1532	616	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 616 wrote to memory of 1532	616	WINWORD.EXE	regsvr32.exe
PID 616 wrote to memory of 1532	616	WINWORD.EXE	regsvr32.exe
PID 616 wrote to memory of 1532	616	WINWORD.EXE	regsvr32.exe
PID 616 wrote to memory of 1532	616	WINWORD.EXE	regsvr32.exe
PID 616 wrote to memory of 1532	616	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1532 regsvr32.exe

pid	process
1532	regsvr32.exe

memory/616-0-0x0000000005DE0000-0x0000000005EE0000-memory.dmp

Filesize
1024KB

Download
memory/1532-3-0x0000000000000000-mapping.dmp

Download