Extracted

• • Target

    3fd7e4fa720f2f7f604709808895d5bf488618ac295de97120ad1a3a8a296009

  • Size

    177KB

  • MD5

    cef4ead9e2724f482eee71be641fd73f

  • SHA1

    3bb8b7be1e1b65faf70fc53206e39aa0a1b7087b

  • SHA256

    3fd7e4fa720f2f7f604709808895d5bf488618ac295de97120ad1a3a8a296009

  • SHA512

    7012df4bd9bb093e22e3fbfd1a244cdf335f2c63f1a59fd13994847ba5b670f792aa02793d0ac3d5f59469900c37fa0fe8c26077eafccdc13d7c934554e25f2c

  • SSDEEP

    3072:te2y/GdyDktGDWLS0HZWD5w8K7Nk9+D7IBUsQdY/R9LG3:te2k4TtGiL3HJk9+D7bsuOLL2

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2