This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mitigation Lockdown

Hello All,

 

I'm trying to figure out if this detection is valid or a false positive. The computer is running Windows 7 and Office 2007. 

PathC:\Windows\SysWOW64\regsvr32.exe

Here is the Raw Data and Process Trace:

 

Mitigation   Lockdown
Timestamp    2020-08-31T14:34:34

Platform     6.1.7601/x64 v321 06_3c-
PID          7280
Application  C:\Windows\SysWOW64\regsvr32.exe
Created      2009-07-13T23:58:32
Modified     2009-07-14T01:14:30
Description  Microsoft(C) Register Server 6.1

Filename     C:\Users\xxxxxxxxx\AppData\Local\Temp\~322103563.exe
Created By   C:\Windows\SysWOW64\regsvr32.exe

Lockdown type:    DenyNewFileExecute

Loaded Modules
-----------------------------------------------------------------------------
74B00000-74C00000 hmpalert.dll (SurfRight B.V.), 
                  version: 3.7.17.317
749D0000-74A0E000 SOPHOS~1.DLL (Sophos Limited), 
                  version: 10.8.8.337
10000000-10035000 temp.tmp (), 
                  version: 

Process Trace
1  C:\Windows\SysWOW64\regsvr32.exe [7280]
"C:\Windows\System32\regsvr32.exe" C:\Users\XXXXX~1\AppData\Local\Temp\temp.tmp
2  C:\Users\Public\in.com [10952]
C:\users\public\in.com C:\users\public\in.html
3  C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE [10268]
C:\PROGRA~2\MICROS~3\Office12\WINWORD.EXE -Embedding
4  C:\Windows\System32\svchost.exe [900]
C:\Windows\system32\svchost.exe -k DcomLaunch
5  C:\Windows\System32\services.exe [780]
6  C:\Windows\System32\wininit.exe [676]
wininit.exe
7  C:\Windows\System32\smss.exe [556]
\SystemRoot\System32\smss.exe 00000000 00000048 
8  C:\Windows\System32\smss.exe [380]
\SystemRoot\System32\smss.exe

Thumbprint
7745bc172997a7decd30745363ec381d0536aa679c85e480287c4b1682aecbe3

Thanks for any assistance.



This thread was automatically locked due to age.
Parents Reply Children
No Data