Extracted

• • Target

    emotet_e2_8ba824dd866fdd551510bd16a8aa9e635047ff142ae942f0764ee739f9189a24_2021-01-13__071626552277._doc

  • Size

    156KB

  • MD5

    5d438ec22ad07c6a6220889ef7ca8aab

  • SHA1

    837c28515cd01cff65f4e45c8c5acf3d692e8ac1

  • SHA256

    8ba824dd866fdd551510bd16a8aa9e635047ff142ae942f0764ee739f9189a24

  • SHA512

    8d9fb5fbfad0d8ff201d47ce68659417503def8ccea1ece737b9f4cd6720adb01923019c30b00b19f7107f0ebe892917fccedbb4a7c5b14570289bd528981173

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1