Extracted

• • Target

    emotet_e2_5df4b703c5848bd3bf897faba1f1142e11c95e17e720a911ade33cdb275f3e0b_2021-01-12__195744664179._doc

  • Size

    158KB

  • MD5

    aed8593d224d3041b5bd0e465ae2b1f5

  • SHA1

    8f1728588225aa4af50e8a8a9580d5ee5fba96f5

  • SHA256

    5df4b703c5848bd3bf897faba1f1142e11c95e17e720a911ade33cdb275f3e0b

  • SHA512

    94d0b097f2840195263790a52e7097a093900016d605497e2b5bb567290912c73f9eecdf02af793ad7e95ce9dafab393027413a1d0eaeb56cab01b67d0bad8de

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1