f691676155a5ce88e8476cc22a8a084b2e4d6e2eb1c8290106fe7113255de829

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 11:40

Target

AzSqlExt.dll
Size

27KB
MD5

4cb38c42a48ab02defdb1e038735a833
SHA1

9b15543f0e82d88158ec8706882c1d926acdebe4
SHA256

f691676155a5ce88e8476cc22a8a084b2e4d6e2eb1c8290106fe7113255de829
SHA512

235d524258741080a729dd62b98f97d1dc84f31d998fbdeee1eaca62fd44554bb218aa5c026256fbde505448142f2aeeb4d2d2ea569dbf26abcbb695fd829fa9
SSDEEP

384:mIOkNWEb782IBmUx0BMON9jp6cBLSx0wzpcve+Zv9AWA3Lma5MezISAPTv+WMpVn:mIjo2IBFKN7zLSF+ELT5RzISAjgRg8

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeAuditPrivilege	1796	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1796	3016	rundll32.exe	28
PID 3016 wrote to memory of 1796	3016	rundll32.exe	28
PID 3016 wrote to memory of 1796	3016	rundll32.exe	28
PID 3016 wrote to memory of 1796	3016	rundll32.exe	28
PID 3016 wrote to memory of 1796	3016	rundll32.exe	28
PID 3016 wrote to memory of 1796	3016	rundll32.exe	28
PID 3016 wrote to memory of 1796	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AzSqlExt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AzSqlExt.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1796