Extracted

• • Target

    emotet_e2_10ca32d172e5dafd7c07e4e27f6c6a24bbb6af319a78a66691b819532b1d2dc1_2021-01-12__192742148400._doc

  • Size

    157KB

  • MD5

    500c1b20832fe365ff049f24f23b8a6a

  • SHA1

    385c2eb40c602fa7d1fb76ca9437932e49b132be

  • SHA256

    10ca32d172e5dafd7c07e4e27f6c6a24bbb6af319a78a66691b819532b1d2dc1

  • SHA512

    a5d63174b2ac31850d0469733692e54896a61b6c6c4e367bb16756f4bed22f718094c179b5f9dddfebf92d3b87392345713fa03ffed98848fa5b88de4a3b53a8

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1