Extracted

• • Target

    8682ecea1dcd31e3d192be7997d0bfc02f1afef72680bb2641ffe66c0e042618

  • Size

    218KB

  • MD5

    cd176f635af723f2a7c9e515995ce72b

  • SHA1

    4c1902b0f950928e40a58065b5498f1c41a3fbeb

  • SHA256

    8682ecea1dcd31e3d192be7997d0bfc02f1afef72680bb2641ffe66c0e042618

  • SHA512

    68f27182c957f4e22ddb21fdcc3673a06c61da9ce462d0f0074516baff9a522f89ee6c9d6a3345c3a24b91f2d665ca85d202fded6e48fb0b645926c9c9c5f79d

  • SSDEEP

    6144:CpL2k4otGiL3HJk9yD7bWDEj3iOERA+nLZByBW2Ufgl:+LxQitkI7bd

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2