purecrypter | b52eb2f20e2e82bdac7e31cea46ec41118ba4bb720f00dce3a0c2cbb1187dc78

Analysis

max time kernel
67s
max time network
71s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-02-2023 01:00

Target

bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe
Size

11KB
MD5

14fec5297bef8c5fa6d3f0f5934dea32
SHA1

5549beb12b3635e878b174ae93d47a147e2f6d98
SHA256

bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7
SHA512

a7889770f7bed2ed2aff36c67cda577cd0ebc064c93532d425d0207bb60f55ee474d6e433402b86704d3f80e442209df53f0bd885d5fcd72b5b229ff5697fda6
SSDEEP

192:cliHh1RDurJEC+88OSM4+pmqQcNM2YDM:cG1d2JEC+lKFI

Score

10^/10

Family

purecrypter

https://vinosbiodinamicos.com/Wnsixjk.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	904	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1672	904	bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe	28
PID 904 wrote to memory of 1672	904	bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe	28
PID 904 wrote to memory of 1672	904	bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe	28
PID 904 wrote to memory of 1672	904	bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe	28

C:\Users\Admin\AppData\Local\Temp\bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe
"C:\Users\Admin\AppData\Local\Temp\bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 1192
  2⤵
  - Program crash
  PID:1672

memory/904-54-0x0000000000BF0000-0x0000000000BF8000-memory.dmp

Filesize
32KB

Download
memory/904-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download