Extracted

• • Target

    9366e0ad583a577c8dc6bb53ff66d4f83bfcd489d7d6446cbae09cd177081d9a

  • Size

    196KB

  • MD5

    484e8d72d6471a2232173a7379cb9e8d

  • SHA1

    b40620454720e562a4e0895631c60cc630a0dea7

  • SHA256

    9366e0ad583a577c8dc6bb53ff66d4f83bfcd489d7d6446cbae09cd177081d9a

  • SHA512

    84ea441646f4301dff26bbbcd3ddb9b8228d7b38031dd61cf0ab738fab533f57d04f63397d6e9d88e2a19ae974ddc5c1a813aab95f254a84e5721ce3ac3dbbf4

  • SSDEEP

    3072:Ex2y/GdyUktGDWLS0HZWD5w8K7Nk9ED7IBU29Y9a1o1ab8lHAWw:Ex2k4ytGiL3HJk9ED7bvlHAW

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2