Extracted

Extracted

• • Target
    tmpu6gdq_l6
  • Size 36KB
  • SHA256 6a920a33daa10abbcbd94fa4e70be5168b8061980e81a69b6346562a49b52d7a
  • MD5 b11cf781f3be157e7fe24a604b1f06ff
  • SHA1 8550b8b1fe508608f104909200b670518c5600ed
  • SHA512 c6d0fff2b8277b0232051055b2410a0ba8eb5e4307ec579391cdabd225c5326909408f870a528c0022e25fd552fa23af8edfc54aba987529187da58b988d03d2
  • SSDEEP 768:+cyHGfCe4YsuWKjB8PZYsger51Qy+LIfx8x5m+qs8T:+cymae48kWy7QxLIfx8x5mU2
  • TLSH
    T1ADF2B06FF111C9A3C6752C7F575C0AE1F91C20972A9AF148750AF6C66720A93134EFD8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  behavioral1behavioral2behavioral3