Extracted

• • Target

    362b17dae1075faba9fe643e328ea5ce5b682e71a90958f2716026c90fd84602

  • Size

    181KB

  • MD5

    2e89f8f34d9c1d63c57c9a545d5298e8

  • SHA1

    5ff5f419ab1e8b2a753aed8cb87351b9299a621d

  • SHA256

    362b17dae1075faba9fe643e328ea5ce5b682e71a90958f2716026c90fd84602

  • SHA512

    13d1218ef783c022b410b5244f3d8c92e904b15517a2cc40507bee31f3dcc932b4ad8501d08e3bb3344ee3d4c60f8f67081d77f466757fad6667341d206067ad

  • SSDEEP

    3072:9NO2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBUdasiv8OP7d:9NO2k4PF7tGiL3HJk9rD7bdasiv86B

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2