Extracted

• • Target

    emotet_e2_8ddff83c83492a8bc6a52b0a004b38fdcfed910dc5f7a8a979bc873e4cdec8bd_2021-01-13__084604376162._doc

  • Size

    157KB

  • MD5

    0b16269cd8eea61cd014cd50c9032324

  • SHA1

    79c7811df437bba954e2efad4845b88fbab4a28a

  • SHA256

    8ddff83c83492a8bc6a52b0a004b38fdcfed910dc5f7a8a979bc873e4cdec8bd

  • SHA512

    5ec829260723fa30f5fc588237733cb4b4a82d8ca1d98754df21bd0a3bab4267dff7881f0473909e77cba58fecdb86d4fc6b63730eb8ec19b71330b8f2ed30de

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1