8a6effb1430c591fa0e6e8ac6f84b1991bf8cc18f70a432ae63e6bda131914c6

Analysis

Target

8a6effb1430c591fa0e6e8ac6f84b1991bf8cc18f70a432ae63e6bda131914c6.xls
Size

106KB
MD5

68e856165288a9bc99a681304b30d552
SHA1

c792461f287fc531967f0f56910b22263e597311
SHA256

8a6effb1430c591fa0e6e8ac6f84b1991bf8cc18f70a432ae63e6bda131914c6
SHA512

23ce7caa40df79663659a898129f25797946a1fe1ded6b970a2b1ef46a43061001d9c341be398be82b1265e7a78ae1251f9197668e008019ecb60ab95ffa7493

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2428	2844	OfficeC2RClient.exe	65

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2428	OfficeC2RClient.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2428	2844	EXCEL.EXE	66
PID 2844 wrote to memory of 2428	2844	EXCEL.EXE	66

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8a6effb1430c591fa0e6e8ac6f84b1991bf8cc18f70a432ae63e6bda131914c6.xls"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
  OfficeC2RClient.exe /error PID=2844 ProcessName="Microsoft Excel" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x800706ba ShowUI=1
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of SetWindowsHookEx
  PID:2428