Extracted

• • Target

    42e6ba1ea816c43320ae4eb3952059263348072339b75e9200a3914b510b044a

  • Size

    32KB

  • MD5

    bb54172287fd2b0e410c5028d561b185

  • SHA1

    e805b5ed52dd4371c8c1fb8cf7458bc84a4a2630

  • SHA256

    42e6ba1ea816c43320ae4eb3952059263348072339b75e9200a3914b510b044a

  • SHA512

    05c8929310cc38a0f97b354c6ff4f1b19ae8f39f647d2cdf423dc397625c19f473e3e167dc956a25fead95f44d659444d917ac09b6e69af948aa2941c73ecaa7

  • SSDEEP

    192:IxSNOlLZEvA+6/6r8px8SmvowzxT4rKVrWGlAtno5hdbeCdCicDlg0jT4V2Iwa:E8iS8px8SMDEyrjStuhdbXdCRlg0jEc

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2