purecrypter | f78bda643bc02054908c347ed64d7244d6da34cd8798aadf6e01313c8803c5bb

Analysis

max time kernel
98s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2023 00:34

Target

5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe
Size

350.1MB
MD5

0180decb30ec5d3934893c90995b2aca
SHA1

181cf9bd4aaa5e0fc3e329f72a32e5fdb5af2e67
SHA256

5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d
SHA512

2edada0d787ca09745a74c4ff9a1c4c6346b72ea544d3d2fab5f5909b190e19f1fd0494bc7c3d5bb972d1c9199a49267d21eac57c5413d65a333a4ea0067e58a
SSDEEP

1536:z+p+iPNAL0z81YHKDgnkt9tMDyC+9BDYz39A:zOvFRCgkIDyt9BDk39A

Score

10^/10

Family

purecrypter

http://justnormalsite.ddns.net/SystemEnv/uploads/nodeffender_Veiwqhsq.jpg

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4468 1388 WerFault.exe 5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe

description pid process

Token: SeDebugPrivilege 1388 5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe

pid	pid_target	process	target process
4468	1388	WerFault.exe	5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe

description	pid	process
Token: SeDebugPrivilege	1388	5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe

C:\Users\Admin\AppData\Local\Temp\5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe
"C:\Users\Admin\AppData\Local\Temp\5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 1696
2⤵
- Program crash
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1388 -ip 1388
1⤵
PID:4200

memory/1388-132-0x0000000000040000-0x0000000000064000-memory.dmp

Filesize
144KB

Download