Extracted

• • Target

    d0aa4009261cd6a957ca054a533007972207d6a1b16452c9ccc164e886dd467c

  • Size

    113KB

  • MD5

    ed2b42212cd661d7495a079f56418d0c

  • SHA1

    6c9e3473cd1bf4e8d4d4f41c111fe1fc8c0afa35

  • SHA256

    d0aa4009261cd6a957ca054a533007972207d6a1b16452c9ccc164e886dd467c

  • SHA512

    5370aa5a2d187b7fe870008e9a753d692583a14a719f20afe9ca37b0b3ba54fef7e86bb23937aba51e9857742e39c57dd5bd8b261f1c10b5e46cc03fae960f62

  • SSDEEP

    1536:bw9kKPubsYwKjtrzu5rGBmRoHynvwMMITLxQOa5tzLEOTsPfxIdxrtgA:0+KgdzSrGYKyIwLx3a4OTsnxA9

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2