Extracted

• • Target

    ec22df822ebdbf9b4fb6510bd677ef0d6ce81e02ed4aaeedb098e178e7eafc9e

  • Size

    217KB

  • MD5

    9233375931f8df6643462a715a569356

  • SHA1

    f1a9097241c4d4ab7501d7ac2fd863b657987ba6

  • SHA256

    ec22df822ebdbf9b4fb6510bd677ef0d6ce81e02ed4aaeedb098e178e7eafc9e

  • SHA512

    05ed488559f36a3fb3982800dc608299feb1600741c81c33c3138abf639a13af702426bf1e525d26f784ffdb549ed57ba16062f1cd3a51ab793a1b6c581ebb6a

  • SSDEEP

    6144:le2k4ytGiL3HJk9uD7bEDYvj3iOE8B+nLZB3oXfg+03:lejQitkQ7bA

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2