927c431738996539062350f11c3f93acb73afd6d429249877accfa50f300315c

Analysis

max time kernel
333s
max time network
419s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:25

Target

资料/12月、1月预订单退货率分析/南京中央.xls
Size

32KB
MD5

29665c97fc5aab79f4620e371e5979f9
SHA1

74f8d134bfde0cfaed289d7be664b33a2353b896
SHA256

be1483ad965ffc7c8b3d6eb8f838e376feb942eea83ae538f5357446b832f043
SHA512

6b354f25d363e13e5a241163650d39bba77fff52e22156a7fe1dd18f94d6f12bbd1c5d951f8be9396810e475327dc13a062b4fbcf057dd55d8a857ac081794f7
SSDEEP

768:QGGGkr1HrTCi9SGxRICqzdR2WKl6Nc7yRzs1H75wkZUiEfClsCq6NqTBun5oEPUa:QGGGkr1HrTCi9SGxRICqzHKl6Nc7yRzk

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

EXCEL.EXE

pid process

5008 EXCEL.EXE

pid	process
5008	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\资料\12月、1月预订单退货率分析\南京中央.xls"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5008

memory/5008-132-0x00007FFF2AAB0000-0x00007FFF2AAC0000-memory.dmp

Filesize
64KB

Download
memory/5008-134-0x00007FFF2AAB0000-0x00007FFF2AAC0000-memory.dmp

Filesize
64KB

Download
memory/5008-133-0x00007FFF2AAB0000-0x00007FFF2AAC0000-memory.dmp

Filesize
64KB

Download
memory/5008-136-0x00007FFF2AAB0000-0x00007FFF2AAC0000-memory.dmp

Filesize
64KB

Download
memory/5008-135-0x00007FFF2AAB0000-0x00007FFF2AAC0000-memory.dmp

Filesize
64KB

Download
memory/5008-137-0x00007FFF288C0000-0x00007FFF288D0000-memory.dmp

Filesize
64KB

Download