Extracted

• • Target

    e1991d3ee7d915f0011c1630d633bd5aa6dbb81a34bbe3774a785579ee3a13c7

  • Size

    200KB

  • MD5

    cf81ff54490d637bfa7b0bca5d8a1c89

  • SHA1

    724eff36db424daa8729d95b4b13573f4ce8bec2

  • SHA256

    e1991d3ee7d915f0011c1630d633bd5aa6dbb81a34bbe3774a785579ee3a13c7

  • SHA512

    458a2f1733998d6db2418278b16fd5a8e36b828f0e29501ea23c9c77566602c7727874340a614215871e2a18401881af4d112bb1b306ec746ca63d5eb6b8c5ae

  • SSDEEP

    3072:+HP9UaqFh5Hr/SzFaSadGBrjC48+WZ/POhh+/JY9a1Zfx4rIqz8aFGcI6kGX:+HP+aqhSzGdD48+aPOngqzxGcI6kG

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2