1a060d1dabd86e25cb6aab039a0fdccd176cb033e5c7823164b97b9284e34191

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 21:56

Target

cateran.docx
Size

32KB
MD5

6ca0f9855f89f8d5b7c66afa03e9d333
SHA1

02bf7c58da5576d86f77699a5aaa2d059c254983
SHA256

24c74262346636f63b0c1afdb64ff000244610ad2ad6a46acb6a596433fede60
SHA512

0ba90446e7f6290f90d3b8b99ee0e8c03cd39e623cbd4ae4ab748c6174d52424b49ab50e765ae71fe278363f8c883c50a65a8e817c788d4a3930fffecab0cfe3
SSDEEP

768:hSMDC5ZCKOFpt292gaJgB6FZuD26V53Ln/p/uRb0lUE8/QZfueL5:457Ojt292gpIZubV53Ln/hul0Kw91

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2036 WINWORD.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXE

pid process

2036 WINWORD.EXE
2036 WINWORD.EXE
2036 WINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
2036	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 2036 wrote to memory of 316	2036	WINWORD.EXE	splwow64.exe
PID 2036 wrote to memory of 316	2036	WINWORD.EXE	splwow64.exe
PID 2036 wrote to memory of 316	2036	WINWORD.EXE	splwow64.exe
PID 2036 wrote to memory of 316	2036	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
19KB

MD5
c60af0d411962c4bc2ad3565b4d6fcfc

SHA1
cfe181cf1a53ed689d699ab8b8ca7d1643b03be9

SHA256
ae0f3ea35bee9acebd3733f17d7483fc9b2971086113e19be4408159fbc2cb3c

SHA512
6ea2448b1bddca813b3798552582d89b02f090e42b053dd3d138fb588a443cc205aea7fa89605b1a9a3935b4307b50891062581c1d35ee1fce0c6e9e844cb591

Download Submit
memory/2036-0-0x000000002FD61000-0x000000002FD62000-memory.dmp

Filesize
4KB

Download
memory/2036-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2036-2-0x000000007177D000-0x0000000071788000-memory.dmp

Filesize
44KB

Download
memory/2036-19-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2036-20-0x000000007177D000-0x0000000071788000-memory.dmp

Filesize
44KB

Download