Extracted

• • Target

    efd4cc52e1dc0f9bb0216e0beb8a8e82edb73d997075f37443cb7f89aea588be

  • Size

    200KB

  • MD5

    4312f79ae438c0296d162c7c01a28e64

  • SHA1

    e3c87785d35bdc6f743724ab45a9804cb5d718fc

  • SHA256

    efd4cc52e1dc0f9bb0216e0beb8a8e82edb73d997075f37443cb7f89aea588be

  • SHA512

    7e97b76532b993d6507511afde87a7d362593bb13ad8318df9088e1386289a437db3b0304e6d30e83d8c63b27b26eb6a1574fd8a14492507816718bea6c8ab91

  • SSDEEP

    3072:G7y2y/GdyDktGDWLS0HZWD5w8K7Nk9KD7IBU9xjCamqFxvhssVAk:ky2k4TtGiL3HJk9KD7b9RCamqFx9/

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2