Extracted

• • Target

    69e1103abdcd93833205d290dde2ff673f1dbaa27bac28a76592e957b2389546

  • Size

    177KB

  • MD5

    a25e6da448a22c85543c6e1f8139726e

  • SHA1

    2a1e423771dbd2a924d8e2f54f52ba3f5209410d

  • SHA256

    69e1103abdcd93833205d290dde2ff673f1dbaa27bac28a76592e957b2389546

  • SHA512

    bee86f442487ac3d9b83f9886d3f5efc5171a20aacc7f829ddcf07e8a89f76821a1c388f02fcc06684142183d3f4d9a554eb2a1edb008adb262b705dc810fee7

  • SSDEEP

    3072:lk2y/Gdy7ktGDWLS0HZWD5w8K7Nk9oD7IBUice6Stoi2l71Y:lk2k47tGiL3HJk9oD7b7Li2l72

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2