Extracted

• • Target
    22-May-24-document-137bcf45.xll
  • Size 12KB
  • SHA256 c8e254f7ea199b0e86278bfbe0e6f8ea107031d7503a04e21ca29918a2502ffb
  • MD5 cbc99f197fd36b22994012714799e4d9
  • SHA1 fd280d3c557ab3af725da54f107e013969dc6848
  • SHA512 7eb45a7fdd2fc7386cf681e650f82a757e4d597b48c038152e2dce1d7b9e9be5f56fe9d1483bfd1c43156c3ee70eae61ff60bcd2edc200e6870c312170d80c53
  • SSDEEP 192:IL29RBzDzeobchBj8JONSONPruKrEPEjr7AhJ:G29jnbcvYJOP5uKvr7CJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2