Extracted

• • Target

    4857c11bedc151833bfa2dfb1b04f6787576e50c395db204ed597e2b2bd36b2a

  • Size

    181KB

  • MD5

    cd1d3c7f464504560580fe44d0c6aba2

  • SHA1

    8b7d1b99dd8e01195005356112e03d02fd45f182

  • SHA256

    4857c11bedc151833bfa2dfb1b04f6787576e50c395db204ed597e2b2bd36b2a

  • SHA512

    088b3babe9e1066afd7c409ebd3057ca805f6c6ca7a8ade1ca28f77d8af0092d4d591824524ebb1eb6fa1f212e4493c8a5335697bf4d31465a26144b0b2bc1ab

  • SSDEEP

    3072:9Ny2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBUcasiv8OP7f:9Ny2k4PF7tGiL3HJk9rD7bcasiv8Wr

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2