Extracted

• • Target

    emotet_e2_91a4617e7fd2b891c584ea3f54b6a9864aca1ba6ac8c5a0a4e450bd374b60f6f_2021-01-13__041155847966._doc

  • Size

    157KB

  • MD5

    d90ca85ef61451da807ca9838e9c3c82

  • SHA1

    914207e890947d1807783d8c3261aefb33ed3718

  • SHA256

    91a4617e7fd2b891c584ea3f54b6a9864aca1ba6ac8c5a0a4e450bd374b60f6f

  • SHA512

    2efb47900a45cb07b9de643cbc1daaa91f765bdde5a372fd49c23abc19c7ea8ce0f6b99a63a0432f3c4c88550cc745cb00b88eff8decaecf195f7bf80ea0e42a

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1