Extracted

• • Target

    emotet_e2_4fe29aa41cda0f5ae9810d21e7073c76901c031256fb1658cdf66a00e33d81f3_2021-01-13__051314156616._doc

  • Size

    158KB

  • MD5

    0b0ff4b7eb90e9db3f048c48343b5d66

  • SHA1

    53d16eb6cb5094b09fc746d1188fc8aa9813e9d6

  • SHA256

    4fe29aa41cda0f5ae9810d21e7073c76901c031256fb1658cdf66a00e33d81f3

  • SHA512

    84a2b0129968b52a9c767ecce5c540ed52148b6da96173f3c429c66b70691efb88488c94b981ed2b70e7020394135c6dece370379ea20f3415d332deef0b891a

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1