Extracted

• • Target

    emotet_e2_2ee522d96c0744b6c157ab83379d1e335b9367df639620dfd9a78a3172d28a1e_2021-01-13__073328653898._doc

  • Size

    157KB

  • MD5

    7caa7d78ed81c354c18f56e7418ec237

  • SHA1

    8974a07d80f6d433b25dc097035c40450f480b69

  • SHA256

    2ee522d96c0744b6c157ab83379d1e335b9367df639620dfd9a78a3172d28a1e

  • SHA512

    e651d354da4b71451a4e223de5ec39cb7cd58b554953f9ebbcaa8cd5498d037389ca3a83d282d85a4165dadc4ab71b4ff7149fd5ace1559809fc935e48cfa6c7

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1