General
- Target files_06.28.2021.doc
- Size 50KB
- Sample210629-9m72l4klda
- SHA256 fd4e3fa8a8d9b59e58e08119e9aba18847b932c1ec8051b0544ebde855c19d46
- MD5 d1a988c49d988c0ce5eb76d5f0f16f2f
- SHA1 49b246f6b3e721f3466ddc3b018ed8c5fb671255
- SHA512 acadf4fe6f7deb366015334689e82bd4a63388f4c8050dc86afb84733471148c7c7cdd387e803cc5d8c50e3ed7d2b056993c4a052ac418414e70fb8022f5df3a
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
files_06.28.2021.doc
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
files_06.28.2021.doc
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Targets
-
- Target files_06.28.2021.doc
- Size 50KB
- SHA256 fd4e3fa8a8d9b59e58e08119e9aba18847b932c1ec8051b0544ebde855c19d46
- MD5 d1a988c49d988c0ce5eb76d5f0f16f2f
- SHA1 49b246f6b3e721f3466ddc3b018ed8c5fb671255
- SHA512 acadf4fe6f7deb366015334689e82bd4a63388f4c8050dc86afb84733471148c7c7cdd387e803cc5d8c50e3ed7d2b056993c4a052ac418414e70fb8022f5df3a
- MD5 SHA1 SHA512
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Blocklisted process makes network request