A retailer sandbox report says the sample spawned a script host, wrote a file, and lists that file's hash. Which section of the report supports the process behavior?
Select an answer to reveal the explanation.
Short Explanation
A hash is a fingerprint on a file, not a story about what the file did after it woke up. You read the spawned script host in the events or systems section, where the report lists process behavior. The trap is treating the hash line, the email subject, or a CVSS vector as that process record.
Full Explanation
The report says the sample spawned a script host and wrote a file. Process behavior is the spawn itself, and that record lives where the detonation lists processes and file activity. The supporting section is "The events or systems section that lists the script host the sample spawned". A hash identifies file content. By itself it does not narrate which process started, so "The hash line alone, read as the record of the process the sample started in detonation" fails. The email subject is delivery context from before detonation. It does not show the script host inside the sandbox, so "The email subject line of the message that carried the sample into the retail store" fails. A CVSS vector is a vulnerability-scoring string, not a process tree, and no score should be invented from it, so "The CVSS vector printed beside the sample, read as if it were the process tree" fails. Exam caveat: keep the hash for identifying the written file, and use the events or systems section for the spawn. Operational check: find the script-host process and the file write together in that section, then use the hash only to name the file that was written.