purecrypter | 5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d

Analysis

max time kernel
94s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2023 13:54

Target

5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe
Size

350.1MB
MD5

0180decb30ec5d3934893c90995b2aca
SHA1

181cf9bd4aaa5e0fc3e329f72a32e5fdb5af2e67
SHA256

5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d
SHA512

2edada0d787ca09745a74c4ff9a1c4c6346b72ea544d3d2fab5f5909b190e19f1fd0494bc7c3d5bb972d1c9199a49267d21eac57c5413d65a333a4ea0067e58a
SSDEEP

1536:z+p+iPNAL0z81YHKDgnkt9tMDyC+9BDYz39A:zOvFRCgkIDyt9BDk39A

Score

10^/10

Family

purecrypter

http://justnormalsite.ddns.net/SystemEnv/uploads/nodeffender_Veiwqhsq.jpg

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3136	1808	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe

C:\Users\Admin\AppData\Local\Temp\5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe
"C:\Users\Admin\AppData\Local\Temp\5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1688
  2⤵
  - Program crash
  PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1808 -ip 1808
1⤵
PID:1256

memory/1808-132-0x00000000004F0000-0x0000000000514000-memory.dmp

Filesize
144KB

Download