aab2c9e64ba3bc97562152cd9fce47d31093b6ae38b6ca0cffc35510a53b57e6

Analysis

Target

file.07.08.2020.doc
Size

147KB
MD5

2b80ba856cc8ef3cb3cf5b79c8fea75b
SHA1

7b3e87693a6c795806f94304852691f81a995623
SHA256

aab2c9e64ba3bc97562152cd9fce47d31093b6ae38b6ca0cffc35510a53b57e6
SHA512

b68251e3168c5c2217d01c582a999efeffb2e8882c59b5b398f4cd706ea328483729a928ffc4d5d305bf285d90dacc637aaad14f90a4b21fcf00e40d4a34aa2a

Score

10^/10

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1804	1492	regsvr32.exe	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1492 wrote to memory of 1804	1492	WINWORD.EXE	regsvr32.exe
PID 1492 wrote to memory of 1804	1492	WINWORD.EXE	regsvr32.exe
PID 1492 wrote to memory of 1804	1492	WINWORD.EXE	regsvr32.exe
PID 1492 wrote to memory of 1804	1492	WINWORD.EXE	regsvr32.exe
PID 1492 wrote to memory of 1804	1492	WINWORD.EXE	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

1804 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1492 WINWORD.EXE

pid	process
1804	regsvr32.exe