purecrypter | d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 10:18

Target

854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
Size

6KB
MD5

e687a214a4e1045485278f75446d7330
SHA1

0525dba91f274da884135f8c2f487a404561309c
SHA256

d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997
SHA512

29cc3137af602fe0a3de279dd8e031631c432787cb4ae8c7538bf5108a8480317810fac52d80f9ddaa4e65675809124331a15b5a1750ed58a181c4cd5a4d7468
SSDEEP

96:1rsKf/efqFIE99JXw3VpzHKTLBKMAtP4JYgdG/lT6eZmFkxctE0gzNt:xt3efqFIE99JXw3XKLBKoldmJjxUE0i

Score

10^/10

Family

purecrypter

https://cdn.discordapp.com/attachments/1069497140126167042/1070236795108868156/Frryusp.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1376 1664 WerFault.exe 854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

description pid process

Token: SeDebugPrivilege 1664 854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

pid	pid_target	process	target process
1376	1664	WerFault.exe	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

description	pid	process
Token: SeDebugPrivilege	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

description	pid	process	target process
PID 1664 wrote to memory of 1376	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe	WerFault.exe
PID 1664 wrote to memory of 1376	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe	WerFault.exe
PID 1664 wrote to memory of 1376	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe	WerFault.exe
PID 1664 wrote to memory of 1376	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 1264
2⤵
- Program crash
PID:1376

memory/1376-56-0x0000000000000000-mapping.dmp

Download
memory/1664-54-0x0000000001260000-0x0000000001268000-memory.dmp

Filesize
32KB

Download
memory/1664-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download