purecrypter | 85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b

Analysis

max time kernel
127s
max time network
132s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 13:02

Target

5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe
Size

6KB
MD5

1b7fda525abb7145a0cf5099a2bb0124
SHA1

5f0445d82f2f59d66d74df0f321bcd63023a87c5
SHA256

85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b
SHA512

8e212b39215328bac75782340957ac71b3fb22f444f7ad18b14eae1a483c0413e870b677cfb48e850a9c4cc5ef182e6d1ae796d4bb7cbaf16446983c06a0d5b1
SSDEEP

96:rmc26N/JsNp8syjxQbw3kBFWkhL6CFRQt15vr3F6JNQikFtCaX/BzNt:rfJRW8HxswUnWaL6YG5vDMoFbX/D

Score

10^/10

Family

purecrypter

http://194.180.49.17/Pruwgxlsz.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1308 1740 WerFault.exe 5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe

description pid process

Token: SeDebugPrivilege 1740 5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe

pid	pid_target	process	target process
1308	1740	WerFault.exe	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe

description	pid	process
Token: SeDebugPrivilege	1740	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe

description	pid	process	target process
PID 1740 wrote to memory of 1308	1740	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe	WerFault.exe
PID 1740 wrote to memory of 1308	1740	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe	WerFault.exe
PID 1740 wrote to memory of 1308	1740	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe	WerFault.exe
PID 1740 wrote to memory of 1308	1740	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1208
2⤵
- Program crash
PID:1308

memory/1308-56-0x0000000000000000-mapping.dmp

Download
memory/1740-54-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/1740-55-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download