Extracted

• • Target

    14ac81b89e181236572ed0b66e260947c0c7795ce4f81d0b05c10476ed519589

  • Size

    181KB

  • MD5

    333492599bec9611f366b4be18c6c76c

  • SHA1

    fddf9adf5652f810aff7333354ed606b1b0dd2a4

  • SHA256

    14ac81b89e181236572ed0b66e260947c0c7795ce4f81d0b05c10476ed519589

  • SHA512

    cee0c8f27b170437f492eeefc500cde88ea423bfa9f76fc24c78fa0c943d9ea210e1e1b1badab4c0e7fce938d651d7097681dfe5229da7080889cf41f1ed078d

  • SSDEEP

    3072:9NW2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBUQasiv8OJ7H:9NW2k4PF7tGiL3HJk9rD7bQasiv8wz

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2