fe3cc52e8f9d230c5c1aa6c442a4b9c37dd4b8ec6954b989dff4702dd1a8b724

Analysis

max time kernel
357s
max time network
407s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:20

Target

申报助理研究员（自然科学、社会科学）相关表格及材料/各职称系列共用的.doc
Size

36KB
MD5

4281aa11556f9d8bd58361426cc3236e
SHA1

fcdbc329a74c32ca6b4b4f3932a209bd6b6266f9
SHA256

1f59c2c81cfda6d928d55b378b0ee78d0567a239883e55c6cbd0e87a24765956
SHA512

f5f8653e6c6415c5c5252da302ed701ddde2036ab18cf392cbc5dfc8dc6b6112f2a3674209bde451dda264ceccf778e727858953959a4ddc918920e2e2b4b5d9
SSDEEP

192:9TikJJAu2a2aYa2aYa2aYa2aYa2aYa2aonnnQzTU8IGR82S/D:9TtsHGRM/

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WINWORD.EXE

pid process

3628 WINWORD.EXE

pid	process
3628	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\申报助理研究员（自然科学、社会科学）相关表格及材料\各职称系列共用的.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
PID:3628

memory/3628-132-0x00007FFCE6030000-0x00007FFCE6040000-memory.dmp

Filesize
64KB

Download
memory/3628-133-0x00007FFCE6030000-0x00007FFCE6040000-memory.dmp

Filesize
64KB

Download
memory/3628-134-0x00007FFCE6030000-0x00007FFCE6040000-memory.dmp

Filesize
64KB

Download
memory/3628-135-0x00007FFCE6030000-0x00007FFCE6040000-memory.dmp

Filesize
64KB

Download
memory/3628-136-0x00007FFCE6030000-0x00007FFCE6040000-memory.dmp

Filesize
64KB

Download
memory/3628-137-0x00007FFCE36D0000-0x00007FFCE36E0000-memory.dmp

Filesize
64KB

Download