ff2576fe2ef3d0e73e1b95e7283535cf0d6874a1da73b31c6c320f25ac2a4245

Analysis

Target
emotet_e2_ff2576fe2ef3d0e73e1b95e7283535cf0d6874a1da73b31c6c320f25ac2a4245_2020-12-22__090853539361._doc.doc
Size 201KB
Sample201222-cwwrsbh162
SHA256 ff2576fe2ef3d0e73e1b95e7283535cf0d6874a1da73b31c6c320f25ac2a4245
MD5 2bd1373c93445533f8924b3da2a8980d
SHA1 2f2cc2e3541a99e099931dce8637dfda67e196e7
SHA512 2ef5883e802a1f1397248262be120a6592d3be560815d114dd01d08ae4e056ed3a6dfa236487635e7f9572172e1323723a8a8d60e44e87a3b3c5d22028008097
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4020	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_ff2576fe2ef3d0e73e1b95e7283535cf0d6874a1da73b31c6c320f25ac2a4245_2020-12-22__090853539361._doc.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
PID:4020