Extracted

• • Target

    emotet_e2_1c5dadca018d0b95208e3d1b84f4200ddaf6a290df549880c032ec214e62c2d5_2021-01-12__191237290154._doc

  • Size

    157KB

  • MD5

    a6db0c333608ec2074e07d56e87fde22

  • SHA1

    913e231f3382cc20a25bad78cee8392a28676362

  • SHA256

    1c5dadca018d0b95208e3d1b84f4200ddaf6a290df549880c032ec214e62c2d5

  • SHA512

    4ab2581d68587cd8c5d0e125248c1978d5491bb8c0718a87df30abb2285d027ea47119608b2b7263ebb155875da5f07202879c88eda9aa553c496fb1f1207bc5

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2