Extracted

• • Target

    5d5a7e355784d6b2db1abd082117fd126c2b512cf4aa0b76561360fbef444b88

  • Size

    32KB

  • MD5

    5634a26e86eaf7761a4f0bb1cd80cd51

  • SHA1

    1f5e043e1f2ead1531b0ff4f378d61009140accc

  • SHA256

    5d5a7e355784d6b2db1abd082117fd126c2b512cf4aa0b76561360fbef444b88

  • SHA512

    695f652dae68ebeec7383a280dfa5bdf5f4afef36e3b32932ffc2fe240389eb6573071b8914fa49f759962a84501b93e32c927a4ee288ce6345e82e99d6e8d03

  • SSDEEP

    192:BRnfa0HZEvAquDUigi6/6rJ984woO+QHj1+WrXefrMiO450jZxtzL6gWCa:B7VDUKiSJPw+QD1+WArM050jZxta

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2