purecrypter | 465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c

Analysis

max time kernel
137s
max time network
218s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11-02-2023 17:19

Target

MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe
Size

23KB
MD5

8531ba62c67d13ce3ad94bcd42bb2c00
SHA1

a9cee94ac6fe7afd2f2647e08330ce47269c57d6
SHA256

465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c
SHA512

a183e13a1c4231a702b7c560b69313684d08ffb46580cd3fbc3641e197560ee61d27ccd109ba457ceac33b62f1fed15a34d6fe0a67f3989b7bfe19f4e39f5c53
SSDEEP

96:mHoxS1E/nqEnkpB0gJ2YGkLtUzVHEHtA6xQkVbR9x5YSGOomjfjw5aBZ7bBlHWFU:y1E/jSOVYrLtF/6ObR9xFyajGaBZzHz

Score

10^/10

Family

purecrypter

https://onedrive.live.com/download?cid=BD9480D014FE52E5&resid=BD9480D014FE52E5%21380&authkey=AITcidcD1qd3mdU

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
556	952	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 556	952	MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe	28
PID 952 wrote to memory of 556	952	MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe	28
PID 952 wrote to memory of 556	952	MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe	28
PID 952 wrote to memory of 556	952	MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1728
  2⤵
  - Program crash
  PID:556

memory/952-54-0x0000000000EA0000-0x0000000000EAC000-memory.dmp

Filesize
48KB

Download
memory/952-55-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download