purecrypter | 85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b

Analysis

max time kernel
121s
max time network
113s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 13:15

Target

5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe
Size

6KB
MD5

1b7fda525abb7145a0cf5099a2bb0124
SHA1

5f0445d82f2f59d66d74df0f321bcd63023a87c5
SHA256

85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b
SHA512

8e212b39215328bac75782340957ac71b3fb22f444f7ad18b14eae1a483c0413e870b677cfb48e850a9c4cc5ef182e6d1ae796d4bb7cbaf16446983c06a0d5b1
SSDEEP

96:rmc26N/JsNp8syjxQbw3kBFWkhL6CFRQt15vr3F6JNQikFtCaX/BzNt:rfJRW8HxswUnWaL6YG5vDMoFbX/D

Score

10^/10

Family

purecrypter

http://194.180.49.17/Pruwgxlsz.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1152	1272	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1152	1272	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe	27
PID 1272 wrote to memory of 1152	1272	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe	27
PID 1272 wrote to memory of 1152	1272	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe	27
PID 1272 wrote to memory of 1152	1272	5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe	27

C:\Users\Admin\AppData\Local\Temp\5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe
"C:\Users\Admin\AppData\Local\Temp\5f0445d82f2f59d66d74df0f321bcd63023a87c5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 1244
  2⤵
  - Program crash
  PID:1152

memory/1272-54-0x0000000001120000-0x0000000001128000-memory.dmp

Filesize
32KB

Download
memory/1272-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download