Extracted

• • Target
    emotet_e2_0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7_2021-01-12__224808987897._doc
  • Size 157KB
  • SHA256 0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7
  • MD5 b1864357f770d51b756a5f201c56853c
  • SHA1 f099888af34b20feb794d711892675062f8298a4
  • SHA512 64827b71e07842f54bc669908cacc259d6c9081eb73030d9bc00b00286f41802a6e8c8adc64ea51fdfdd74b4cda5df857eb9b6b827d5db08bda9db6d56ad541b
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2