Extracted

• • Target

    emotet_e2_f400967f088ce94383aa01857a6c797a4d0073813b29a8c1ccb0769342caa4c0_2021-01-13__075434909440._doc

  • Size

    156KB

  • MD5

    811c0576e7d8775ee5b0bf6a3c28d26b

  • SHA1

    61936c90195f4b38573a4ec5f6dfb22458bf2597

  • SHA256

    f400967f088ce94383aa01857a6c797a4d0073813b29a8c1ccb0769342caa4c0

  • SHA512

    03664990c889ddf25b69e7215f710c59342144b06c6cdedf2d0377d5b59b6b90c6531ede2081b3d7395ed8c7fa5554026e1430af7984cb1af8cc2be6337deea9

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2