Extracted

• • Target

    emotet_e2_d537bf50ec4b548ea84743bd82fca89f61456fdabd24530cb04214c8d7fe7043_2021-01-13__001012989263._doc

  • Size

    156KB

  • MD5

    b3cf743783b6f8e185f5fdacfcfe4290

  • SHA1

    749597f5ddc62e36326b7df100243b8a7cd90667

  • SHA256

    d537bf50ec4b548ea84743bd82fca89f61456fdabd24530cb04214c8d7fe7043

  • SHA512

    8b44341680ecac562615bf3b60dd48c1eba3b1ee4e754f21faf03b9dfffe505f416c4aef0c70f87349dc2c8e18820c7ab31de12bb30c7112d8d9ab339a84b161

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2