Extracted

• • Target

    emotet_e2_1d60cf7a5a88c9b4a1b2c9ea649413891cd78db09b85027981ec9491cb954e1b_2021-01-13__055146500164._doc

  • Size

    157KB

  • MD5

    291a7c60009acbf393623d048bd5f48f

  • SHA1

    a694d68a9f7303fb6dcc1f97d21ef25cfc22318e

  • SHA256

    1d60cf7a5a88c9b4a1b2c9ea649413891cd78db09b85027981ec9491cb954e1b

  • SHA512

    559da6be3dac860f519606e3d9f1938108f5912a821c6a8d1c027b9416576d42e6fe774132f1781e84704b45023bcc7f54206d7200a3f66ae7a844fd39098263

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2