95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44 | Triage

Analysis

max time kernel
107s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
22/03/2021, 07:58

Sharing

Report Analysis Logs

General

Target

MsWord.exe
Size

8.3MB
MD5

de6717de7bd1daa595c0b00887c25f05
SHA1

f70cc94796e6f89499a3958d7fd2001e50a984f0
SHA256

95cfd76bfea8839d2c545cc10d1c94131868471d51ccb8a4525058f591f92b44
SHA512

eca079d83bd0c0e57e64479dcaf4437c0029a13e1506d117a6f4a139439e4dfacc2b5271822d8b1fc08219bebee9f2c788284290f74aca3d0ac77184e804303b

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2040	MsWord.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	MsWord.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2040	1632	MsWord.exe	26
PID 1632 wrote to memory of 2040	1632	MsWord.exe	26
PID 1632 wrote to memory of 2040	1632	MsWord.exe	26

C:\Users\Admin\AppData\Local\Temp\MsWord.exe
"C:\Users\Admin\AppData\Local\Temp\MsWord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\MsWord.exe
  "C:\Users\Admin\AppData\Local\Temp\MsWord.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-5-0x000007FEFC1C1000-0x000007FEFC1C3000-memory.dmp

Filesize
8KB

Download