Extracted

• • Target

    cd683b73c9c229ef9b69fffc66f9db4473bec903c015a5e3a618db02df19e8fc

  • Size

    202KB

  • MD5

    1098728a67a0978f1ffec7cd2d127091

  • SHA1

    f73e4f9d94babadd53c617947f684463be825695

  • SHA256

    cd683b73c9c229ef9b69fffc66f9db4473bec903c015a5e3a618db02df19e8fc

  • SHA512

    764b28dc7acb288a0c418c89b098b94596c8046f6caae4a4e222158100d92656f4844a8fbf02a0ec923d2931eb0d6062f5ab06a635fb0231977a8114f41b6582

  • SSDEEP

    3072:M9ufstRUUKSns8T00JSHUgteMJ8qMD7grBiplB3dlBtLph:M9ufsfgIf0pLcplB3dlBtLph

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2