80d066815446eefd8b1cdb6ba6d877fd4db3f4b8143d08499cafed382b0ce1cd

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 17:45

Target

EnableQ Developer's Manual.doc
Size

493KB
MD5

db7d8e31ca0931ed2712f2b963f0b616
SHA1

fc5113cbc5827cf8e5063c785169d1674d8b670b
SHA256

978ce158708bb8778d2a42f02a2e9e97ae80e566ae6546593844956b63889b6c
SHA512

95090e62f659aff573b7e16807a83301f4eff4115af8f7a26f1cbbc4ca96c7b687bc0ef106f5aa5169727ae08e4d42bf9f59a50462f32fa0e7ad867c5e259ab2
SSDEEP

6144:nOhvbcPFegd4PnbCSWWWWbaCPTOoYnpeAbAhPLF/sjoiFkBY7IRK+QrU:AjSnC1/TOoYnlbGPLJsjoiFkBk

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2388	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2388	WINWORD.EXE
2388	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2868	2388	WINWORD.EXE	32
PID 2388 wrote to memory of 2868	2388	WINWORD.EXE	32
PID 2388 wrote to memory of 2868	2388	WINWORD.EXE	32
PID 2388 wrote to memory of 2868	2388	WINWORD.EXE	32

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
c2fa3c295c8f27e0cbf45f8f08cd6db9

SHA1
e22af6251b08dbf34cfb276990540d9fb283703b

SHA256
96847fd22137fcb530a7ff1e4cdd21b1901d3ae613d44d24ff39cd3e0dddbeb4

SHA512
227485345eaaa7dfbd77e67206dd43df41f84a125594c152964d837a67fb047e0afdf0cb039f4c8d49ee92e20727902ba3be4e0c1e0a89bd32b5a89529befa64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2388-0-0x000000002F051000-0x000000002F052000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2388-2-0x0000000071A7D000-0x0000000071A88000-memory.dmp

Filesize
44KB

Download
memory/2388-11-0x0000000071A7D000-0x0000000071A88000-memory.dmp

Filesize
44KB

Download
memory/2388-32-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download