Extracted

• • Target

    78cb5ae63364f07ef80aed5b3519fda06750053b1e65d226f09e159b42847071

  • Size

    171KB

  • MD5

    dc6229943a8b00cbca4ea6f70b3c9c08

  • SHA1

    5eb56bab75a2db1dfc58866a875d822a97ba6c97

  • SHA256

    78cb5ae63364f07ef80aed5b3519fda06750053b1e65d226f09e159b42847071

  • SHA512

    af1c42c5aca7c10e468aef6a5a1e7a07c088864ffef4db88c3845deb0fa8b115d30ea44f03d4d25f068d42f82f2afce5557109b318042cd104f1533568d46d6c

  • SSDEEP

    3072:I12y/GdyDktGDWLS0HZWD5w8K7Nk9dD7IBUBNGp4HAIoy:I12k4DtGiL3HJk9dD7bvPHAID

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2