Extracted

• • Target
    emotet_e2_d28bde1ee5fdd7503e931d3388cc0fdfd2cd36fbd85ed35235e2b828bcc99b90_2021-01-13__012622649047._doc
  • Size 157KB
  • SHA256 d28bde1ee5fdd7503e931d3388cc0fdfd2cd36fbd85ed35235e2b828bcc99b90
  • MD5 6a472e0b71d0f9f9990c4ccc219945db
  • SHA1 d331fe4c75d27a314646486edf783a5114fb7f4f
  • SHA512 9d8f2214bf13a4c317234d83b4324d0ff188b1ba07700a3336ac8c99f905935dd8e4b4800e8bfdf99e74e1d6ed7f8e3bc98f56d4ac934a78554fac1fd2b64dc9
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2