Extracted

• • Target

    2acba15b1c90192f22dd2115fb3cd0bdb4ca815d46d7f5c96c166acae782ade7

  • Size

    200KB

  • MD5

    60a4887782152c9150471daaf3df61a3

  • SHA1

    69b3931f92b1e2b6b149c35a421a0c74796bf83f

  • SHA256

    2acba15b1c90192f22dd2115fb3cd0bdb4ca815d46d7f5c96c166acae782ade7

  • SHA512

    7783d5257322677d0395fd72421c985a685e4aa522c8426a189be257a13a6c5114fd86ce9db563098fc713d5271a111db9892e4c4d7feb413d4fa758aa5d6bbc

  • SSDEEP

    3072:Am2y/GdyjktGDWLS0HZWD5w8K7Nk9LD7IBUzlwCDuRdj95ksW:Am2k4ztGiL3HJk9LD7bpwC6Rdj95kv

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2