Extracted

• • Target
    emotet_e2_8c2f83d72c4e23bb25c6c7eb77d454db3994f2dd2c4cacde4a29011c0a029055_2021-01-13__002615872906._doc
  • Size 157KB
  • SHA256 8c2f83d72c4e23bb25c6c7eb77d454db3994f2dd2c4cacde4a29011c0a029055
  • MD5 37f09032e9a1a53a5252c8a09db41b16
  • SHA1 321ccb333f668f24282ea9e38b322ea145c585fa
  • SHA512 b120e93ddd795a712fa5c181cd3de455a3ddffc0323a1f6d8105031e6958ac49a82e2f8570815ca5f6755094197e5f57198ab5ef7a4e7e336d18e02fed06ce1a
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2