Extracted

• • Target

    emotet_e2_13ede1e9cb06a6abe06852ba6a76f88ddb689b084f5aeba3e0191db38eb60818_2021-01-13__063411397175._doc

  • Size

    158KB

  • MD5

    3d691936eae7bc966b4dfcbd5ba13535

  • SHA1

    fe9641bc70012cdf61b73fdf08cbad8d044ab478

  • SHA256

    13ede1e9cb06a6abe06852ba6a76f88ddb689b084f5aeba3e0191db38eb60818

  • SHA512

    3c7eafab342e49139829acd8f0f8f9dd5b4d114ccdd32dec391051f7fe36df52f9550411a116b185a3d53560e9b5719bc7b698eaddb3938a39dbdd37d7e71e6a

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2