Extracted

• • Target
    emotet_e2_bdcd5f7db27ea098d9dbd6d561c81bbd0014a42688d4ccac2f799da3ffa17a30_2021-01-13__060226731463._doc
  • Size 157KB
  • SHA256 bdcd5f7db27ea098d9dbd6d561c81bbd0014a42688d4ccac2f799da3ffa17a30
  • MD5 a707c3fc57f474a31b67d15f4b994119
  • SHA1 80f0a0d10d3117f599a008a318e74e931beda998
  • SHA512 1744766504c7c65432da9a6e7cbc81790b7b4839a3d8523f559692eb3062b3fda3d4405efde86ceed6f185dc7f568b506a5375fde42bd6b4cd58915f1fac6710
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2