azorult | 7e9bb4c2cf0700791726df6dcc5f6a92f10a5fc09bbb3b89821c580cfc9b6a5f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 19:54

Target

47c4b4026c749cc0c150fb61aa721cf0_JaffaCakes118.dll
Size

428KB
MD5

47c4b4026c749cc0c150fb61aa721cf0
SHA1

81f9d99720a74187959b5a936dff9756c075a458
SHA256

7e9bb4c2cf0700791726df6dcc5f6a92f10a5fc09bbb3b89821c580cfc9b6a5f
SHA512

f2374d96dea2015c521b6429018f2b24ee7484d002e426435698a8f4f923d348567409123deee73cc2f44a483d8bb2ed92fdd0ed2ac7173e46e075b560fd9f9a
SSDEEP

3072:aj346fmKD5IcMXhBomoBtq2HFAe89Vqli89LPK6bPndS3fudCQnh8WYFT/fVZZxd:ajo6O25GXu02l+QiaBbPntd/8W

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2272 wrote to memory of 216	2272	rundll32.exe	rundll32.exe
PID 2272 wrote to memory of 216	2272	rundll32.exe	rundll32.exe
PID 2272 wrote to memory of 216	2272	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c4b4026c749cc0c150fb61aa721cf0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47c4b4026c749cc0c150fb61aa721cf0_JaffaCakes118.dll,#1
2⤵
PID:216

memory/216-0-0x00000000010F0000-0x0000000001117000-memory.dmp

Filesize
156KB

Download
memory/216-1-0x0000000000FC0000-0x0000000000FE3000-memory.dmp

Filesize
140KB

Download
memory/216-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/216-11-0x0000000000FC0000-0x0000000000FE3000-memory.dmp

Filesize
140KB

Download
memory/216-12-0x0000000001140000-0x000000000115D000-memory.dmp

Filesize
116KB

Download
memory/216-10-0x0000000000F10000-0x0000000000F30000-memory.dmp

Filesize
128KB

Download
memory/216-13-0x0000000074895000-0x0000000074896000-memory.dmp

Filesize
4KB

Download
memory/216-14-0x0000000000FC0000-0x0000000000FE3000-memory.dmp

Filesize
140KB

Download