purecrypter | 780b6ba7fa2126b7f172c23c31474b2eedbd2ac9cd0018c5763f77213995a56b

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2023, 09:23

Target

ID180717.exe
Size

5KB
MD5

7339a847d0f1ca1691330101fc02d5bf
SHA1

35782cd13a72166a37f77e505f69ee20921d7759
SHA256

780b6ba7fa2126b7f172c23c31474b2eedbd2ac9cd0018c5763f77213995a56b
SHA512

0f7974a6211f95b84a75a0681c3076df543756a19fb1ec5999049f4dff64ba0d4af622a9efa944ae1f70845bc439f666cdc867be18a06dd36c09ec208f0b9885
SSDEEP

48:6uwuF4FM1qnXGSsThsfATgQpXVKPYMIjLIMJMQGAg4MGR7P7XencMsdqBHtitiOv:uWIXbseoTg09dZGAl9P7XgGksnUBzNt

Score

10^/10

Family

purecrypter

https://carlcederlaw.com/thh/Uzsggeh.dat

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1528	2608	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	ID180717.exe

C:\Users\Admin\AppData\Local\Temp\ID180717.exe
"C:\Users\Admin\AppData\Local\Temp\ID180717.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1696
  2⤵
  - Program crash
  PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2608 -ip 2608
1⤵
PID:4792

memory/2608-132-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/2608-133-0x0000000005260000-0x0000000005804000-memory.dmp

Filesize
5.6MB

Download
memory/2608-134-0x0000000004D90000-0x0000000004E22000-memory.dmp

Filesize
584KB

Download