Extracted

• • Target

    emotet_e2_6531485e7908b63b71fed89fd7a5e90a7d0250b15f1f9f25552776518ecf1b94_2021-01-13__005843871828._doc

  • Size

    157KB

  • MD5

    b0ceac39b2f58dc74b3bef3358f5150f

  • SHA1

    1c62910c2219f9fa508982827f14c594c2a8bdec

  • SHA256

    6531485e7908b63b71fed89fd7a5e90a7d0250b15f1f9f25552776518ecf1b94

  • SHA512

    c7590ccc7dea7f9b425a0872c3d091db39affd5b9b007373325c95df9031fe7a6833fada3ac4ad7a23f3c8f8e56976bf74c1a90ba2b02a67bc19f32b8a12ee3b

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2