Extracted

• • Target

    6d66dc25fb069a43ca04adf00eece16f55d791b5cd44bb236937472f80f8f731

  • Size

    184KB

  • MD5

    7eb6d8d961091ae592e051d5e424638e

  • SHA1

    88921697521edca2a7252fed4e24f5acfbc82e21

  • SHA256

    6d66dc25fb069a43ca04adf00eece16f55d791b5cd44bb236937472f80f8f731

  • SHA512

    fa5abd3b805ccb926a6e4cdaaa3d6f65cb15e4dd9905ca80039b7b063631a80080ae9eaeba147a8698124986881d51f49860cf7b21229efffbc121e746ee3d7c

  • SSDEEP

    3072:R+2y/GdyrktGDWLS0HZWD5w8K7Nk9aD7IBUeoUH9CBjBoax5waA1NWBM0zR:R+2k4TtGiL3HJk9aD7beoUH9CBjBoaxP

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2