9c99f39aa789216d1d1599ecb28c8e6d27b69153392389b12ad9972b9a7f58bd

Analysis

max time kernel
245s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 21:29

Target

15e5fd5da7e0c399d4cc110e8a3de1a0.doc
Size

24KB
MD5

15e5fd5da7e0c399d4cc110e8a3de1a0
SHA1

f95f89cc8e0ed63e849dbe07795eabf6c8d962e5
SHA256

9c99f39aa789216d1d1599ecb28c8e6d27b69153392389b12ad9972b9a7f58bd
SHA512

098e57c9f0ddc17cd9eb1e3bb657d96e7f30896b328107d0500525d221eec125ca03a9515e15223d33c293373dce6e9ad3b1483a2c77de64966fbe3dc708bd28
SSDEEP

384:fhq450jdRCKMK+peg/ikoSPObPjkyzQ/ZA5TPWKsxgT7pf:f3odsKMK+pegqkoKO9WITPVsaT

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WINWORD.EXE

pid process

4020 WINWORD.EXE

pid	process
4020	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\15e5fd5da7e0c399d4cc110e8a3de1a0.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
PID:4020

memory/4020-132-0x00007FFA76C10000-0x00007FFA76C20000-memory.dmp

Filesize
64KB

Download
memory/4020-133-0x00007FFA76C10000-0x00007FFA76C20000-memory.dmp

Filesize
64KB

Download
memory/4020-134-0x00007FFA76C10000-0x00007FFA76C20000-memory.dmp

Filesize
64KB

Download
memory/4020-135-0x00007FFA76C10000-0x00007FFA76C20000-memory.dmp

Filesize
64KB

Download
memory/4020-136-0x00007FFA76C10000-0x00007FFA76C20000-memory.dmp

Filesize
64KB

Download
memory/4020-137-0x00007FFA74B60000-0x00007FFA74B70000-memory.dmp

Filesize
64KB

Download