Extracted

• • Target

    emotet_e2_8d5c3655c17e7b52765884c6c65f4accd5e2d174f1b28c4a9a25b5b3686c50b7_2021-01-13__005200763832._doc

  • Size

    158KB

  • MD5

    5d945215f920eb558ea283588ea0ad85

  • SHA1

    d762746064e6aa7cec9c595bb00c64d7ae9f8ca8

  • SHA256

    8d5c3655c17e7b52765884c6c65f4accd5e2d174f1b28c4a9a25b5b3686c50b7

  • SHA512

    d9b63634ffeb29aa702ead72d42fba551bf571969354030c397b7eacf86a99fb440e2f731c688b55e8f942c8f8277e49be6a8c822e2dccc7a4a523d86b8873d7

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1