Extracted

• • Target
    emotet_e2_5df4b703c5848bd3bf897faba1f1142e11c95e17e720a911ade33cdb275f3e0b_2021-01-12__195744664179._doc
  • Size 158KB
  • SHA256 5df4b703c5848bd3bf897faba1f1142e11c95e17e720a911ade33cdb275f3e0b
  • MD5 aed8593d224d3041b5bd0e465ae2b1f5
  • SHA1 8f1728588225aa4af50e8a8a9580d5ee5fba96f5
  • SHA512 94d0b097f2840195263790a52e7097a093900016d605497e2b5bb567290912c73f9eecdf02af793ad7e95ce9dafab393027413a1d0eaeb56cab01b67d0bad8de
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2