Extracted

• • Target

    emotet_e2_866744b3695d0b0c7d2e887aa1d3b2be95583ae6a88f31fbc0f4f6c150477804_2021-01-13__025450123435._doc

  • Size

    157KB

  • MD5

    6a14e1ab7eb60599fd10444c80d45e65

  • SHA1

    7291b11876ce306a58a4432ac650de87bdb8e592

  • SHA256

    866744b3695d0b0c7d2e887aa1d3b2be95583ae6a88f31fbc0f4f6c150477804

  • SHA512

    269646f8a3fd37d497061aa60a0bd0af77f9bd65a01908f926f8bb765fe69025400261216f3aa7e16eb0cc82af2ff9ccc3fa83a92f9dde8c48c6161753100692

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1