Extracted

• • Target

    emotet_e2_bd45f2cb32d66093175c05e0b8e9060fbcc0fcaca57454dfab3abf0d54711f13_2021-01-12__232547453467._doc

  • Size

    156KB

  • MD5

    c2a6dca60bb2fc070af93998909002b7

  • SHA1

    41e08e9627aba565d0eed0d15bc7331e6490bdea

  • SHA256

    bd45f2cb32d66093175c05e0b8e9060fbcc0fcaca57454dfab3abf0d54711f13

  • SHA512

    6a74c10312a691274a9112647971330fc86b3965dfe2199c8e18b5225fcec141cfa86ffa3c4c668d1e40472ffa874bd7a8b138dc8b8d5be723a6b05fd025ef08

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1