5c28b949507a6330ec9e768251131e823e1ed1587b5e8913c9e70009f235e9bb

Analysis

max time kernel
313s
max time network
404s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:04

Target

base/RegisterUninstall.exe.xml
Size

270B
MD5

455e49ce62c15e710109e27d796bc07b
SHA1

c5fb946c32bbf485298ccce382dd7ef360e2b80f
SHA256

6353cd37e2d0debdcec72ecad91e6022dc14b355462a1cc0350993f8a268017e
SHA512

09e45a644654e477116ca6d8fe96f2cdb3b1fb5269c4a694cb7e8e3e387ce440e250bea4f9b792d4ffb56a057379447e1d7ce49aa3416fe0181ef0f5b53f532e

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

MSOXMLED.EXE

description	pid	process	target process
PID 3728 wrote to memory of 3656	3728	MSOXMLED.EXE	iexplore.exe
PID 3728 wrote to memory of 3656	3728	MSOXMLED.EXE	iexplore.exe

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\base\RegisterUninstall.exe.xml
  2⤵
  PID:3656

memory/3728-132-0x00007FFA01630000-0x00007FFA01640000-memory.dmp

Filesize
64KB

Download
memory/3728-133-0x00007FFA01630000-0x00007FFA01640000-memory.dmp

Filesize
64KB

Download
memory/3728-134-0x00007FFA01630000-0x00007FFA01640000-memory.dmp

Filesize
64KB

Download
memory/3728-135-0x00007FFA01630000-0x00007FFA01640000-memory.dmp

Filesize
64KB

Download
memory/3728-136-0x00007FFA01630000-0x00007FFA01640000-memory.dmp

Filesize
64KB

Download