Extracted

• • Target

    d9847123b526161e5454f0b6ba07218041ccc47e15171972c3d04d681a1bfba0.rtf

  • Size

    81KB

  • MD5

    afb14dcb82dbb041183e8d492c415a13

  • SHA1

    6e75ff4e6d06c9824d9a9b50061d22c21f7d659f

  • SHA256

    d9847123b526161e5454f0b6ba07218041ccc47e15171972c3d04d681a1bfba0

  • SHA512

    f5adb4a97c5d6bc8a8102c70b2bc3f4b05bc5ea1acbeae6457d654510d46cbeb3018880e64c487ebeaee89978827871f951e025220bed25bbddfb1ae5b6e0ac8

  • SSDEEP

    384:Ghvwphf2vHXsv6kBBZK9llGuaPJ4QmwhzofOQT6pLcdYa9eyDAPI/uVOP8d465Q7:Ghxv8LB0MJwwSfOQOO1eyDAA/kdJg

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2