Extracted

• • Target

    emotet_e2_580d52825b9a6edbca506c1e194a832f55d4967ab507bd4c34a91aa6f3190ebd_2021-01-13__052703402555._doc

  • Size

    157KB

  • MD5

    fdcd75f1bf755f45082c15649ce2feb5

  • SHA1

    478af6ad4b9c8011f7f2386d2f2187bc610a97f9

  • SHA256

    580d52825b9a6edbca506c1e194a832f55d4967ab507bd4c34a91aa6f3190ebd

  • SHA512

    454fce5a42358d3df25c7f2c9d6b4eacc23954a1ed619b848c2a712be1863ce9a3dc264578697f2f59f292846e8ca0a2811a84acf88f4e2b4246ec2bd9d8535a

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1