Extracted

• • Target

    InvoiceG4969162doc.doc

  • Size

    230KB

  • MD5

    1b661c46bc3352c7e2362ba4854d219a

  • SHA1

    9cbe40cff5576408c2cc83946489316f43963409

  • SHA256

    b9d2bc9624f1e81b007fd1d89170294eb6eb29c779f83f4e75576a0fa3fa421a

  • SHA512

    d92df1c0fedab8b4416e83f33f6a85714cf91221c1cdda0f224c93de5a662dfecd97cab66dfac0d839799aa47b82ca1226ecbb99d597a7fdb434f15f6b16636a

  • SSDEEP

    3072:cj6yw1MgpQiBhGWb6esLbTh8YuyDRBFtdfGkzRVLmgGjMBwwDR2C:cHgtEWPsL/aTyT9Gk1u0wwDRR

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Drops file in System32 directory

  behavioral1behavioral2