503fedaaad4914ad8c22fd4a2311711ee049c5d5c8134d0961d4ba23a29d7447

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 12:49

Target

asar/linux安装asar文件解压打包组件.docx
Size

16KB
MD5

973a163e8cb4d6c4da477dd6e6b78063
SHA1

c25cdc29859d0131971c5122bc5de1ff6b64e5f6
SHA256

e58679811fe06fd16642942a8f61b77eb8c5f3efcee7396ec5e41b77da46d7dd
SHA512

c897f7bd124053118063d8a28a71b2ee2e4245d9726d63176541921eb415a9dfecda195260d11b2f4cf91fab428a97faa62cbd347c1dff82dc012c3739f19743
SSDEEP

192:jhvAkoUR7fznSqqi6+zxFgbET6sjbnlJ1jtyQDubjya4LOrgDBIwMIT1TkRiW:d7bRnnzqi6q2oTjjlwQDubmxqgFSpRiW

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2800 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2800 WINWORD.EXE
2800 WINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
2800	WINWORD.EXE

pid	process
2800	WINWORD.EXE
2800	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 2800 wrote to memory of 2748	2800	WINWORD.EXE	splwow64.exe
PID 2800 wrote to memory of 2748	2800	WINWORD.EXE	splwow64.exe
PID 2800 wrote to memory of 2748	2800	WINWORD.EXE	splwow64.exe
PID 2800 wrote to memory of 2748	2800	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
19KB

MD5
edfdae071105eb66cbcf94826ad819f3

SHA1
b457d3fe9c79c5105e20d1b3a2ff3cfa2d049e27

SHA256
19a4baccb2dfe9b2cba3d28c098b42b2c5c74a690f1ee69918a25d0395fc7478

SHA512
2f7c2a15e3fea5cb8187072e24d9b4665b5f8c6968c3d3a669dc9b5b74001f49fd507a153e822e7b1aed56857f73daeaa8b894a6c4b9c5d5e2dc263a1b2ed85a

Download Submit
memory/2800-0-0x000000002F741000-0x000000002F742000-memory.dmp

Filesize
4KB

Download
memory/2800-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2800-2-0x000000007111D000-0x0000000071128000-memory.dmp

Filesize
44KB

Download
memory/2800-8-0x000000007111D000-0x0000000071128000-memory.dmp

Filesize
44KB

Download
memory/2800-29-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download