Extracted

• • Target

    emotet_e2_d2232dfab1a3d97b00285d3baeedaff80ee090c7fb8bec50f6fb23554fc7d4aa_2021-01-13__013314177141._doc

  • Size

    157KB

  • MD5

    aa7e98010a10bc2406d352c565676199

  • SHA1

    2f8f65e6db91d0929e12d4008e7bcddde196e238

  • SHA256

    d2232dfab1a3d97b00285d3baeedaff80ee090c7fb8bec50f6fb23554fc7d4aa

  • SHA512

    f405323642171c7bf5b559d200cac09661f52e9c0dee84bd9e98e2f81d7d9fcc2784b47d94b03c218c39494ec522d4003a2d28989c93da80d17b76934c4dc42f

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2