24de2b71477635f2bdb96e6990ed37de9cb8848dd29210ffe8ddd1d0ec948734

Analysis

max time kernel
374s
max time network
398s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 16:54

Target

temp/ppt/slideLayouts/_rels/slideLayout11.xml
Size

311B
MD5

3403b99991b21ed32f5d796eae81897b
SHA1

0e95a84096cd52097d3d2cdefa3f259e598be0b1
SHA256

8246d333bf3764cd35563e3df1828c26bbc28890815a2987caf3e592791ba60d
SHA512

29836bb54ac0f53bc11e5df71e76ab6a0eb0c005aba71a83685c0f1bdba8406662fbd51e79eec215f79cbafa4b2a88b1ddc087a0d6f0fdf1a6d666f068553495

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

MSOXMLED.EXE

description	pid	process	target process
PID 2864 wrote to memory of 4244	2864	MSOXMLED.EXE	iexplore.exe
PID 2864 wrote to memory of 4244	2864	MSOXMLED.EXE	iexplore.exe

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\temp\ppt\slideLayouts\_rels\slideLayout11.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\temp\ppt\slideLayouts\_rels\slideLayout11.xml
2⤵
PID:4244

memory/2864-132-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download
memory/2864-133-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download
memory/2864-134-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download
memory/2864-135-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download
memory/2864-136-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download
memory/2864-137-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download
memory/2864-138-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download
memory/2864-139-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download
memory/2864-140-0x00007FFE28930000-0x00007FFE28940000-memory.dmp

Filesize
64KB

Download