purecrypter | d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997

Analysis

max time kernel
57s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2023 10:18

Target

854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
Size

6KB
MD5

e687a214a4e1045485278f75446d7330
SHA1

0525dba91f274da884135f8c2f487a404561309c
SHA256

d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997
SHA512

29cc3137af602fe0a3de279dd8e031631c432787cb4ae8c7538bf5108a8480317810fac52d80f9ddaa4e65675809124331a15b5a1750ed58a181c4cd5a4d7468
SSDEEP

96:1rsKf/efqFIE99JXw3VpzHKTLBKMAtP4JYgdG/lT6eZmFkxctE0gzNt:xt3efqFIE99JXw3XKLBKoldmJjxUE0i

Score

10^/10

Family

purecrypter

https://cdn.discordapp.com/attachments/1069497140126167042/1070236795108868156/Frryusp.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1096 400 WerFault.exe 854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

description pid process

Token: SeDebugPrivilege 400 854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

pid	pid_target	process	target process
1096	400	WerFault.exe	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

description	pid	process
Token: SeDebugPrivilege	400	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1956
2⤵
- Program crash
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 400 -ip 400
1⤵
PID:3304

memory/400-132-0x00000000008A0000-0x00000000008A8000-memory.dmp

Filesize
32KB

Download