Extracted

• • Target

    emotet_e2_aeb7e57a542c2cb29a53066da881fb4fafcb9b81bc2738b411044b61b0e5e443_2021-01-12__221338711839._doc

  • Size

    157KB

  • MD5

    fd8fe5fe8a2fc4303f6fa8888ef89f32

  • SHA1

    8500ad430a7a66b112d6546bed8858ad65cb9d89

  • SHA256

    aeb7e57a542c2cb29a53066da881fb4fafcb9b81bc2738b411044b61b0e5e443

  • SHA512

    ebc197016790a051a7d8b889c68988d41ed49d9deffd8290dcfa04026fe8abb1e3cbe245b1f0d0654e219bc2f23bf1ff4c4fda8d2787460d9e6264b626922bf5

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1