Extracted

• • Target

    emotet_e2_6a315fd4a06b02bf1f99d4b3ab1aaaaed955bca3224dc90447f6135160434f85_2021-01-12__235334975995._doc

  • Size

    157KB

  • MD5

    5d6457174e58386fbafd68ee6112bc96

  • SHA1

    dff82aa1a7201a5f5d5d61c2e929050e8bb5aa48

  • SHA256

    6a315fd4a06b02bf1f99d4b3ab1aaaaed955bca3224dc90447f6135160434f85

  • SHA512

    32a6cf44bb1b208c4f9a88941db7c4e5721c301a76c0714247927af8f6fb4e1645e231479969c4c222f033a850a4f81038d0756e5753f6106a4ce3f5f03a0db5

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1