azorult | eccedd34de1c201add9ca865e09bf93f7d28ac07efc93b14928f4562566a5557

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 21:26

Target

311d2960fde78dcd0b4685fd84959787_JaffaCakes118.exe
Size

207KB
MD5

311d2960fde78dcd0b4685fd84959787
SHA1

8f264bb18f16c33273dda5e560a642739836ab62
SHA256

eccedd34de1c201add9ca865e09bf93f7d28ac07efc93b14928f4562566a5557
SHA512

76f63656a18f945bae287152ca4e103ffb73c1dada714209694ded0dd40b54328b62c26d754b01de9e4847f10e5b99ac502f6e6fa501ee6bb086fbef10eca486
SSDEEP

3072:ATax4wQBNam5TZfKKW38fp6VWZg7X0IrC+viNMUkA+XqX3gud6hwjQ5BcV:0az4p9fp6EZg7XVO+vXXk3Bd6heyc

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3576	3244	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\311d2960fde78dcd0b4685fd84959787_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\311d2960fde78dcd0b4685fd84959787_JaffaCakes118.exe"
1⤵
PID:3244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 1384
  2⤵
  - Program crash
  PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3244 -ip 3244
1⤵
PID:1676

memory/3244-1-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/3244-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3244-3-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3244-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download