Extracted

• • Target

    d9646f7930b56f53d15c7219242c6baa6ba46140b24b6a64968f3758e0352043

  • Size

    184KB

  • MD5

    0bc51659259980fded8d6e127a6a886e

  • SHA1

    5a944956e1c556fcec6310c4286218e62161a15b

  • SHA256

    d9646f7930b56f53d15c7219242c6baa6ba46140b24b6a64968f3758e0352043

  • SHA512

    9a386caf62eec21b5c00386a9b155ede0e936019b1c674504acac4df33998bcd7f80df02ff9d0b764a15fa9a0df2e44df3e7b414eca3a7e00f09b9beffa8a0e8

  • SSDEEP

    3072:C92y/GdynktGDWLS0HZWD5w8K7Nk9uD7IBUQUasgt+PpkkrbfzHQfzZExXMHIwtV:C92k43tGiL3HJk9uD7bQUasFPpkkrbfk

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2