purecrypter | 5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 13:54

Target

5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe
Size

350.1MB
MD5

0180decb30ec5d3934893c90995b2aca
SHA1

181cf9bd4aaa5e0fc3e329f72a32e5fdb5af2e67
SHA256

5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d
SHA512

2edada0d787ca09745a74c4ff9a1c4c6346b72ea544d3d2fab5f5909b190e19f1fd0494bc7c3d5bb972d1c9199a49267d21eac57c5413d65a333a4ea0067e58a
SSDEEP

1536:z+p+iPNAL0z81YHKDgnkt9tMDyC+9BDYz39A:zOvFRCgkIDyt9BDk39A

Score

10^/10

Family

purecrypter

http://justnormalsite.ddns.net/SystemEnv/uploads/nodeffender_Veiwqhsq.jpg

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1604	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1912	1604	5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe	28
PID 1604 wrote to memory of 1912	1604	5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe	28
PID 1604 wrote to memory of 1912	1604	5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe	28
PID 1604 wrote to memory of 1912	1604	5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe	28

C:\Users\Admin\AppData\Local\Temp\5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe
"C:\Users\Admin\AppData\Local\Temp\5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1192
  2⤵
  - Program crash
  PID:1912

memory/1604-54-0x0000000000130000-0x0000000000154000-memory.dmp

Filesize
144KB

Download
memory/1604-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download