azorult | 27c92fe6c131c4f41f6d524837ba073f396130658c51108f94cb514b7f571dc4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 00:41

Target

$PLUGINSDIR/lyinn.dll
Size

26KB
MD5

b7f9a167c3af210c5a0be8393b9f04e2
SHA1

8e540308abf226139bf08c61fa21598c0eb055da
SHA256

fd6451ef4e817f604a14be5ab85b5e9890a276ba877d38a9b9544c41ed4718a7
SHA512

75a44e8939f23fa143b67fbd664b81758c0718343e7cb3836b5651bd87e0533d03973b34cbb7b03b50a1fb3828fb0ddf93b205f42e0c8198bfb575088dc9b128
SSDEEP

384:CWt7vqwJ2B3uyRZ3rcg3b8WWA5oYjH8T9jwiXaqQUfkysX:1sBBH3I6WS78T5FX5fkv

Score

10^/10

Family

azorult

http://21slg.xyz/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	944	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1692	2848	rundll32.exe	28
PID 2848 wrote to memory of 1692	2848	rundll32.exe	28
PID 2848 wrote to memory of 1692	2848	rundll32.exe	28
PID 2848 wrote to memory of 1692	2848	rundll32.exe	28
PID 2848 wrote to memory of 1692	2848	rundll32.exe	28
PID 2848 wrote to memory of 1692	2848	rundll32.exe	28
PID 2848 wrote to memory of 1692	2848	rundll32.exe	28
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 1692 wrote to memory of 944	1692	rundll32.exe	29
PID 944 wrote to memory of 2356	944	rundll32.exe	30
PID 944 wrote to memory of 2356	944	rundll32.exe	30
PID 944 wrote to memory of 2356	944	rundll32.exe	30
PID 944 wrote to memory of 2356	944	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lyinn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lyinn.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lyinn.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 196
      4⤵
      Program crash
      PID:2356

memory/944-1-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/944-4-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/944-9-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/944-7-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/1692-0-0x0000000074DE0000-0x0000000074DEA000-memory.dmp

Filesize
40KB

Download
memory/1692-10-0x0000000074DE0000-0x0000000074DEA000-memory.dmp

Filesize
40KB

Download