purecrypter | d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 10:18

Target

854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
Size

6KB
MD5

e687a214a4e1045485278f75446d7330
SHA1

0525dba91f274da884135f8c2f487a404561309c
SHA256

d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997
SHA512

29cc3137af602fe0a3de279dd8e031631c432787cb4ae8c7538bf5108a8480317810fac52d80f9ddaa4e65675809124331a15b5a1750ed58a181c4cd5a4d7468
SSDEEP

96:1rsKf/efqFIE99JXw3VpzHKTLBKMAtP4JYgdG/lT6eZmFkxctE0gzNt:xt3efqFIE99JXw3XKLBKoldmJjxUE0i

Score

10^/10

Family

purecrypter

https://cdn.discordapp.com/attachments/1069497140126167042/1070236795108868156/Frryusp.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	1664	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1376	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe	28
PID 1664 wrote to memory of 1376	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe	28
PID 1664 wrote to memory of 1376	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe	28
PID 1664 wrote to memory of 1376	1664	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 1264
  2⤵
  - Program crash
  PID:1376

memory/1664-54-0x0000000001260000-0x0000000001268000-memory.dmp

Filesize
32KB

Download
memory/1664-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download