e9ece01a6eca9300135fb86e026d112f3a225ab7f7dc7ee3b84db5a7a09c6255

Analysis

max time kernel
2s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2023 14:00

Target

[sus]MicrosoftOffice.exe
Size

3.9MB
MD5

ada5630f85ca2226d5335e81f4d3f976
SHA1

378f136d0453a34280b8df29cf5d5246d91dc271
SHA256

cb423b98e439f5dbf05f1caeb00700724b32137006422be1a4d893da5ae07224
SHA512

24c73592abdd9600bf79649199dcb50adc02cbbfd709d3bda20c435480f8ff5be5872c4d0e1afb67c43abc52f30509748b60cc019205c1c40340954f59658125
SSDEEP

98304:2UvUNvbkNtNBs7rXwa7E0RPVF+2vbLhg1tuaK929veSURdzD2cFJz5:2UYvbkfNBs7WevR2cFJz5

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

[sus]MicrosoftOffice.exe

description	pid	process	target process
PID 4920 wrote to memory of 3808	4920	[sus]MicrosoftOffice.exe	cmd.exe
PID 4920 wrote to memory of 3808	4920	[sus]MicrosoftOffice.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\[sus]MicrosoftOffice.exe
"C:\Users\Admin\AppData\Local\Temp\[sus]MicrosoftOffice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4920

C:\Windows\system32\cmd.exe
cmd /k "start /b" C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp_qjgete.xls
2⤵
PID:3808