Extracted

• • Target

    88c21aca9eea505566e48cc3a3499e64a59388a72344fba266a368a48f709379

  • Size

    213KB

  • MD5

    9b96db7be7f7bb48a86cc089ff54f78f

  • SHA1

    2777c17ed6883b4a35591cc085179cf23871f91f

  • SHA256

    88c21aca9eea505566e48cc3a3499e64a59388a72344fba266a368a48f709379

  • SHA512

    b5488c94a2ce9269ed8d90c63fd915eb3529fe18bf91fe3acef715967f726cb7efcb701ce958c850b612bb018fad8e73ff99cf80c1bec37428f29c3fd4017d19

  • SSDEEP

    6144:112k4CtGiL3HJk9ZD7blUwDtWvs+ZIFnL:11TQitkv7bOGnL

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2