Extracted

• • Target

    emotet_e2_1482d4727689bb4aedeeb0dc3658dd0ec67d73c6fc1e66bc1ab074bc4b6dd739_2021-01-13__044843002447._doc

  • Size

    157KB

  • MD5

    67aafc5857276c77bcdeaf3ed9dd46c6

  • SHA1

    a7e132b8ee1ccfa65b61c8c9444483a296e7ec91

  • SHA256

    1482d4727689bb4aedeeb0dc3658dd0ec67d73c6fc1e66bc1ab074bc4b6dd739

  • SHA512

    e82c62109dfca6ac7068fb870aaedafbab155b2971d871dc7790f854ad24ab8b52e540ad8610be20bcdc658afb6fa5adfb4e78f54794fa4bb0bba0ee4e3c7780

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1