Extracted

• • Target
    emotet_e2_91a4617e7fd2b891c584ea3f54b6a9864aca1ba6ac8c5a0a4e450bd374b60f6f_2021-01-13__041155847966._doc
  • Size 157KB
  • SHA256 91a4617e7fd2b891c584ea3f54b6a9864aca1ba6ac8c5a0a4e450bd374b60f6f
  • MD5 d90ca85ef61451da807ca9838e9c3c82
  • SHA1 914207e890947d1807783d8c3261aefb33ed3718
  • SHA512 2efb47900a45cb07b9de643cbc1daaa91f765bdde5a372fd49c23abc19c7ea8ce0f6b99a63a0432f3c4c88550cc745cb00b88eff8decaecf195f7bf80ea0e42a
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2