96435116036a60721193eae3aaed145ab019d97f2d23be25dca9e4e5dfb9c138

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 07:30

Target

FedEx Delivery Express Service.docx
Size

24KB
MD5

5706d6116d5621d932c745a0528ab9a7
SHA1

ac1e38b8dbef42c367e5f881438db6e04ecddbf6
SHA256

96435116036a60721193eae3aaed145ab019d97f2d23be25dca9e4e5dfb9c138
SHA512

40f2d75da8abb7b60ddcd76c24e54e41dde5698da5f388aebd3f4551f4b5fd526b023e281bac7020008e4e05a66756919f9f3cc9b19ef3c34cbb0c76ed5e5a24
SSDEEP

768:neeXhslszfIpCI9I3v2ql2S1uhOtKSTgP5joyhM1/B:njXZfIpCsmvX2S1uktKS+doWM1/B

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2096	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2096	WINWORD.EXE
2096	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2988	2096	WINWORD.EXE	32
PID 2096 wrote to memory of 2988	2096	WINWORD.EXE	32
PID 2096 wrote to memory of 2988	2096	WINWORD.EXE	32
PID 2096 wrote to memory of 2988	2096	WINWORD.EXE	32

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
6a8b29396c43979f656da8af8efa8fdb

SHA1
95d70d9d01ddf1aa0b3c82b449843d0257fb3f81

SHA256
3888a92031316e93c927bad428043a5982be3826a9bddb2472d51812d4d40c55

SHA512
83497be0f5d9aac9b61f6ccf43da6f30a0282073c748b43be8898f6334916de91e3da9fb8c976d845b0dde14f4ef17fe9289bda34617843631fa6ba6a13177fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2096-54-0x000000002FB80000-0x000000002FCDD000-memory.dmp

Filesize
1.4MB

Download
memory/2096-55-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2096-56-0x00000000711ED000-0x00000000711F8000-memory.dmp

Filesize
44KB

Download
memory/2096-73-0x000000002FB80000-0x000000002FCDD000-memory.dmp

Filesize
1.4MB

Download
memory/2096-74-0x00000000711ED000-0x00000000711F8000-memory.dmp

Filesize
44KB

Download
memory/2096-94-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2096-95-0x00000000711ED000-0x00000000711F8000-memory.dmp

Filesize
44KB

Download