503fedaaad4914ad8c22fd4a2311711ee049c5d5c8134d0961d4ba23a29d7447

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 16:15

Target

asar/linux安装asar文件解压打包组件.docx
Size

16KB
MD5

973a163e8cb4d6c4da477dd6e6b78063
SHA1

c25cdc29859d0131971c5122bc5de1ff6b64e5f6
SHA256

e58679811fe06fd16642942a8f61b77eb8c5f3efcee7396ec5e41b77da46d7dd
SHA512

c897f7bd124053118063d8a28a71b2ee2e4245d9726d63176541921eb415a9dfecda195260d11b2f4cf91fab428a97faa62cbd347c1dff82dc012c3739f19743
SSDEEP

192:jhvAkoUR7fznSqqi6+zxFgbET6sjbnlJ1jtyQDubjya4LOrgDBIwMIT1TkRiW:d7bRnnzqi6q2oTjjlwQDubmxqgFSpRiW

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2076 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2076 WINWORD.EXE
2076 WINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
2076	WINWORD.EXE

pid	process
2076	WINWORD.EXE
2076	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 2076 wrote to memory of 2084	2076	WINWORD.EXE	splwow64.exe
PID 2076 wrote to memory of 2084	2076	WINWORD.EXE	splwow64.exe
PID 2076 wrote to memory of 2084	2076	WINWORD.EXE	splwow64.exe
PID 2076 wrote to memory of 2084	2076	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
19KB

MD5
68754d7998374541e8bebe6be06bf3a2

SHA1
3d96c625ed3a601e37475f275cdafffec3c9e182

SHA256
d0982bb27075ab996509a88efc95f1a3ee3437737e32b835e2016772c65f8af3

SHA512
ad3ee74f5f2968307a23bc426c7f0016c11dbdedaaf3124c9ab5933bf2df50dd85e4c778bf385c507439d3a11292953023f4fbb10b4316993a76a71bf072d93b

Download Submit
memory/2076-0-0x000000002F631000-0x000000002F632000-memory.dmp

Filesize
4KB

Download
memory/2076-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2076-2-0x000000007165D000-0x0000000071668000-memory.dmp

Filesize
44KB

Download
memory/2076-13-0x000000007165D000-0x0000000071668000-memory.dmp

Filesize
44KB

Download
memory/2076-34-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download