fb32dc19a45870bf171c1d45da207408e2627f64a49300dc12ba851fcdabc17b

Analysis

max time kernel
337s
max time network
353s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:22

Target

VDA6.3 2010过程审核（更新）/过程审核实施计划.doc
Size

44KB
MD5

5d3171a0aea46f86d4b82e7999a7a9d8
SHA1

3c1fb5074028904f36307ef0ae9ab873d5537580
SHA256

0b9fb415753eb140e2899002cc6867ea43ce1eca9343d8e69966c2974e7093f5
SHA512

d6b41bfeb9dc855d0e08bc420280ffc74eccd6dc45f069a7e2a006a68b775c259430fd35d3871939f4baffc960b36af5fc108bd098f2cfc155f02f03d787ba7a
SSDEEP

192:sI7xvRdRs1zX1MmxEK5RfWbNIpIpIpn0n0+eN4PHUG4yGc6rdRBwAEwfG4JliDNN:R7xvRfs11MA7yGcSxwAjL7ipXwewA7H

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WINWORD.EXE

pid process

4724 WINWORD.EXE

pid	process
4724	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\VDA6.3 2010过程审核（更新）\过程审核实施计划.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
PID:4724

memory/4724-132-0x00007FFEFC670000-0x00007FFEFC680000-memory.dmp

Filesize
64KB

Download
memory/4724-133-0x00007FFEFC670000-0x00007FFEFC680000-memory.dmp

Filesize
64KB

Download
memory/4724-134-0x00007FFEFC670000-0x00007FFEFC680000-memory.dmp

Filesize
64KB

Download
memory/4724-135-0x00007FFEFC670000-0x00007FFEFC680000-memory.dmp

Filesize
64KB

Download
memory/4724-136-0x00007FFEFC670000-0x00007FFEFC680000-memory.dmp

Filesize
64KB

Download
memory/4724-137-0x00007FFEFA340000-0x00007FFEFA350000-memory.dmp

Filesize
64KB

Download