Extracted

• • Target
    emotet_e2_1c5dadca018d0b95208e3d1b84f4200ddaf6a290df549880c032ec214e62c2d5_2021-01-12__191237290154._doc
  • Size 157KB
  • SHA256 1c5dadca018d0b95208e3d1b84f4200ddaf6a290df549880c032ec214e62c2d5
  • MD5 a6db0c333608ec2074e07d56e87fde22
  • SHA1 913e231f3382cc20a25bad78cee8392a28676362
  • SHA512 4ab2581d68587cd8c5d0e125248c1978d5491bb8c0718a87df30abb2285d027ea47119608b2b7263ebb155875da5f07202879c88eda9aa553c496fb1f1207bc5
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2