Extracted

• • Target

    1ca58e2d712a736b1880fca6dd15e3a929241704359c8d01dd5f8c1eaaf5cc1d

  • Size

    181KB

  • MD5

    22853095067f42ea30fe518a306b7385

  • SHA1

    d9b9134ec206dfba8c0fd9def38155ae40479432

  • SHA256

    1ca58e2d712a736b1880fca6dd15e3a929241704359c8d01dd5f8c1eaaf5cc1d

  • SHA512

    93c649fb86e37e1ac8c97c1e8310f5bd18231163eb84dd1ac2c065fe1759c76d1f33749a69430282ba42022d20fc7b6ff83aa04dadc63ff53816f75794f74601

  • SSDEEP

    3072:9NO2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBUQasiv8OM7v:9NO2k4PF7tGiL3HJk9rD7bQasiv8N7

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2