purecrypter | d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2023 10:19

Target

854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
Size

6KB
MD5

e687a214a4e1045485278f75446d7330
SHA1

0525dba91f274da884135f8c2f487a404561309c
SHA256

d93a085b25b48d63db9001337dd2fd8a4bd5554b95c15302d5423e77047f0997
SHA512

29cc3137af602fe0a3de279dd8e031631c432787cb4ae8c7538bf5108a8480317810fac52d80f9ddaa4e65675809124331a15b5a1750ed58a181c4cd5a4d7468
SSDEEP

96:1rsKf/efqFIE99JXw3VpzHKTLBKMAtP4JYgdG/lT6eZmFkxctE0gzNt:xt3efqFIE99JXw3XKLBKoldmJjxUE0i

Score

10^/10

Family

purecrypter

https://cdn.discordapp.com/attachments/1069497140126167042/1070236795108868156/Frryusp.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	444	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	444	854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe

C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 1972
  2⤵
  - Program crash
  PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 444 -ip 444
1⤵
PID:3812

memory/444-132-0x0000000000150000-0x0000000000158000-memory.dmp

Filesize
32KB

Download