Extracted

• • Target

    623b52a41069600922f0faa472e2b0d6cf338fed34d025e955d1b6420aa68f6b

  • Size

    182KB

  • MD5

    6fb57a9bfccd1dd2062de639145dccf8

  • SHA1

    be4730e9e66fdefd1f2a91fd37cce331ee123cd4

  • SHA256

    623b52a41069600922f0faa472e2b0d6cf338fed34d025e955d1b6420aa68f6b

  • SHA512

    c09897e03fb2ecb0d5908da8cf165a0fcc871ba2b8750131e131b39275878ca6d36850a43152292b90ddc53d38b66203fff57e79f6c621fc8a80163d594696bf

  • SSDEEP

    3072:9Nh2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBUdasiv8OP7F:9Nh2k4PF7tGiL3HJk9rD7bdasiv86J

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2