Extracted

• • Target

    emotet_e2_f8721e02d2a1b17f4f0c25a48de68111b8fba9021c0d52937db63b6b71de90e7_2021-01-13__083113091866._doc

  • Size

    156KB

  • MD5

    191c542af0b15a2c3b2c8cff405c8b4d

  • SHA1

    da79e0c4428fda33df8a1908cc0232106a889971

  • SHA256

    f8721e02d2a1b17f4f0c25a48de68111b8fba9021c0d52937db63b6b71de90e7

  • SHA512

    5943b1c12ad50c4488e16990ecd83d67e258741986201490e852dbbebb45451e15c9b0189001c8ac559d14eb1e88abfd558c4a4a4ad27bcf6b410fb6b2290269

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2