Extracted

• • Target

    61ba115b9679ffcb94f789f8238af529b4dd810fbc3130f0a60dcfd0e8e8bc69

  • Size

    12KB

  • MD5

    a4afc2a894f765f03c95152f7af21246

  • SHA1

    a034dc3bf870351aa92f28ab728ff7fff77ecc07

  • SHA256

    61ba115b9679ffcb94f789f8238af529b4dd810fbc3130f0a60dcfd0e8e8bc69

  • SHA512

    10065421dc4e8e2ae35e147c859765d76ee9aacd77bd7c2c1db888c7d99a42955b26f4f38d6e7de5048c3345dcd7518a77542363ffd3fa4e1183f96cb9091e6d

  • SSDEEP

    192:sL29RBzDzeobchBj8JON8ONcEJrutrEPEjr7Ahf:C29jnbcvYJOJHutvr7Cf

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2