Extracted

• • Target

    f78464c2347f7ae809d8b66d6b14f458a3d3d13364e8520ef39b814cd0a3328a

  • Size

    200KB

  • MD5

    26626dc1b76b8bfe603bde42ce48c157

  • SHA1

    3f5d1b392f72ad2396598c4d0610cd80e5d98583

  • SHA256

    f78464c2347f7ae809d8b66d6b14f458a3d3d13364e8520ef39b814cd0a3328a

  • SHA512

    64ce037835fa515eb9994ffe5caf363e5fc1d044e7f54dbd694bacb96140824f284b41dee4202a4306b7c9bdb60c75516c184a9570cc49f3d72d3776de5da35d

  • SSDEEP

    3072:1m2y/GdyjktGDWLS0HZWD5w8K7Nk9LD7IBUhlwCDuRdj95ksS:1m2k4ztGiL3HJk9LD7bzwC6Rdj95kl

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2