Extracted

• • Target

    aa2f65c66cba4f2c08c42bf553a5a5b23d661315757b1c34b3103f8f441f940e

  • Size

    56KB

  • MD5

    0b5783fe1f26934294c18ce26b172473

  • SHA1

    4c2d0c2e06b745266ff6c957b491f03e7a92aa97

  • SHA256

    aa2f65c66cba4f2c08c42bf553a5a5b23d661315757b1c34b3103f8f441f940e

  • SHA512

    192bf58e0937f43273c51f03cbc874687f1425a471abc33e4f3a351d04ad297a0a06b1a32fc0747bab230b915dbbc41535a091e564626a3516a316f9d5f5935d

  • SSDEEP

    1536:8k3hOdsylKlgryzc4bNhZFGzE+cL2knAzqCKwzFpjiE:8k3hOdsylKlgryzc4bNhZFGzE+cL2kn1

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2