purecrypter | a09aa78a6c9f321201451849e023bd671b7115a845ab22aafe2c2ccb3c6c3193

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 02:13

Target

ORDEN_DE.exe
Size

46KB
MD5

38606e7f142ae07f54e9b3a2f556f9af
SHA1

3b1683c3f5297247ffb699860a839c5e0e36e01f
SHA256

0132ac2fb25ba504a685e4e6674af0506a25201b0b94653b896e7912af7bc494
SHA512

e5b28981397d7ba30ebd77f503d4a447467158cac6fee520eb0c18a943d813189e49d373573ed89b7b3ce6a64ee1d4a5a9614ac3e44fdaa2cf8b34b79c6de3b6
SSDEEP

192:W3M066tgw7yhB0t85HL6/4JCSYx8tfMHHoYYwOJ4eZAEdKdO58rP4Ggi47saXCBq:W8Buyn0t8FvG8tUHHojSe7i29JXYam/

Score

10^/10

Family

purecrypter

http://2.56.57.22/Szzkx_Jlhaxwdp.png

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1672 2040 WerFault.exe ORDEN_DE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ORDEN_DE.exe

description pid process

Token: SeDebugPrivilege 2040 ORDEN_DE.exe

pid	pid_target	process	target process
1672	2040	WerFault.exe	ORDEN_DE.exe

description	pid	process
Token: SeDebugPrivilege	2040	ORDEN_DE.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ORDEN_DE.exe

description	pid	process	target process
PID 2040 wrote to memory of 1672	2040	ORDEN_DE.exe	WerFault.exe
PID 2040 wrote to memory of 1672	2040	ORDEN_DE.exe	WerFault.exe
PID 2040 wrote to memory of 1672	2040	ORDEN_DE.exe	WerFault.exe
PID 2040 wrote to memory of 1672	2040	ORDEN_DE.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1056
2⤵
- Program crash
PID:1672

memory/1672-56-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/2040-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download