Extracted

• • Target

    4098f5b921f52056b8e4a02d2cee1a184de9494d1e0fd769dc724d9448e2ee35

  • Size

    36KB

  • MD5

    c19dfe0f345e7b378aa3930348196a66

  • SHA1

    2553d815242b68e108b7b9548b5d013c8d1f0887

  • SHA256

    4098f5b921f52056b8e4a02d2cee1a184de9494d1e0fd769dc724d9448e2ee35

  • SHA512

    344dfcbcc9af4ccf3f16285f627fb371aef4dd7123413fc0a97503a8f43107f59b1f13500c970c31b565510eaaced9d46c9ad403857600021844ff4312c16f2e

  • SSDEEP

    384:jQ8iSsqdg1vA97ZIaNeiIIAbv/YMA0jsytd:jt+1o9t7efIAK1c

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2