Extracted

• • Target

    d553754670d5b53200ddec4869f28f269a650ecf315a6f9eac6b8771ec0165a7

  • Size

    178KB

  • MD5

    ea36973f28119717d12411b067e1aa41

  • SHA1

    875eb82f2e135f33a04bcc9aebe808425e73d06e

  • SHA256

    d553754670d5b53200ddec4869f28f269a650ecf315a6f9eac6b8771ec0165a7

  • SHA512

    469733be8ea5a3f251007ffb4a420f436dcb00c7706f91c66eb14f4377770e7126a95e8308ec8b17ca281d88ce610f3a266c057342c4e46d064f0553b515cec9

  • SSDEEP

    3072:JT2y/GdynktGDWLS0HZWD5w8K7Nk96D7IBUJZB0zstySfNllXe:JT2k43tGiL3HJk96D7bt0z0rllX

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2