Extracted

• • Target

    emotet_e2_cd26143fd22b6cbf5db4309ecc97366923ad7b8de7ae9870ef31c0700f41a121_2021-01-12__222613747576._doc

  • Size

    157KB

  • MD5

    bff195f2d6491db57936bd802a76db58

  • SHA1

    b62071a41c7f68260ffa116012428b7a274675df

  • SHA256

    cd26143fd22b6cbf5db4309ecc97366923ad7b8de7ae9870ef31c0700f41a121

  • SHA512

    151a9b0c370165a5fb19b24c5084cdfcb570b32b5d3625348728a82c04dad1ed13d8b5329ed0f03026a5c20849214b67f4c0283b69380727bced4b1f6b506275

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1