Extracted

• • Target
    emotet_e2_c1386cfa76e20ef89543333e71c40fdbbec97db19367409d0d96bd4fe370ff30_2021-01-13__014002582426._doc
  • Size 157KB
  • SHA256 c1386cfa76e20ef89543333e71c40fdbbec97db19367409d0d96bd4fe370ff30
  • MD5 8e6d588ca0f29f37e2314bd376b229ad
  • SHA1 6e36d352a8ece5282d31c35263c149f2e981e2e7
  • SHA512 e591be7ac9e4212bf55661c30587283c69b5fbe52790189ea665eff66a98c0dcfaee25ad662138cabdb9dc4f575dccaa88058be30ba0d9030f1979f77fbc7a24
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2