abc8d1097f0249c749f2c7d7058be1b39c88e21d26d45d76985c989289565214

Analysis

max time kernel
128s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2022 15:56

Target

actionplan doc 08.11.docm
Size

2.2MB
MD5

933338ca2c25cfda5c124455216d6709
SHA1

e518d12b7bb4addf1dc041a05575031890c1b4d7
SHA256

abc8d1097f0249c749f2c7d7058be1b39c88e21d26d45d76985c989289565214
SHA512

57d89f7b2319e6725bc72e06b3e00b13b4e23445a723bb84fc3d0d199b8546b7e30de68c4b90a3244aaad7b974c3e6bbe8695ab0cacac8aef18ccceae3c741c5

Score

10^/10

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

WerFault.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3800	956	WerFault.exe	WINWORD.EXE

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3800 956 WerFault.exe WINWORD.EXE
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

956 WINWORD.EXE
956 WINWORD.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE

pid process

956 WINWORD.EXE
956 WINWORD.EXE
956 WINWORD.EXE
956 WINWORD.EXE

pid	pid_target	process	target process
3800	956	WerFault.exe	WINWORD.EXE

pid	process
956	WINWORD.EXE
956	WINWORD.EXE

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 196 -p 956 -ip 956
1⤵
PID:4588

memory/956-130-0x00007FFD32570000-0x00007FFD32580000-memory.dmp

Filesize
64KB

Download
memory/956-131-0x00007FFD32570000-0x00007FFD32580000-memory.dmp

Filesize
64KB

Download
memory/956-132-0x00007FFD32570000-0x00007FFD32580000-memory.dmp

Filesize
64KB

Download
memory/956-133-0x00007FFD32570000-0x00007FFD32580000-memory.dmp

Filesize
64KB

Download
memory/956-134-0x00007FFD32570000-0x00007FFD32580000-memory.dmp

Filesize
64KB

Download
memory/956-135-0x00007FFD2FCA0000-0x00007FFD2FCB0000-memory.dmp

Filesize
64KB

Download
memory/956-136-0x00007FFD2FCA0000-0x00007FFD2FCB0000-memory.dmp

Filesize
64KB

Download
memory/956-137-0x0000015DF6FDC000-0x0000015DF71BF000-memory.dmp

Filesize
1.9MB

Download
memory/956-138-0x0000015DF6BF0000-0x0000015DF6CE6000-memory.dmp

Filesize
984KB

Download