purecrypter | c97e39c3560473ee1cbd225aadf3a4cad262bbe0740b011dc9e93450e68ec110

Analysis

max time kernel
39s
max time network
135s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 01:38

Target

465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c.exe
Size

23KB
MD5

8531ba62c67d13ce3ad94bcd42bb2c00
SHA1

a9cee94ac6fe7afd2f2647e08330ce47269c57d6
SHA256

465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c
SHA512

a183e13a1c4231a702b7c560b69313684d08ffb46580cd3fbc3641e197560ee61d27ccd109ba457ceac33b62f1fed15a34d6fe0a67f3989b7bfe19f4e39f5c53
SSDEEP

96:mHoxS1E/nqEnkpB0gJ2YGkLtUzVHEHtA6xQkVbR9x5YSGOomjfjw5aBZ7bBlHWFU:y1E/jSOVYrLtF/6ObR9xFyajGaBZzHz

Score

10^/10

Family

purecrypter

https://onedrive.live.com/download?cid=BD9480D014FE52E5&resid=BD9480D014FE52E5%21380&authkey=AITcidcD1qd3mdU

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	1864	WerFault.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1324	1864	465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c.exe	26
PID 1864 wrote to memory of 1324	1864	465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c.exe	26
PID 1864 wrote to memory of 1324	1864	465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c.exe	26
PID 1864 wrote to memory of 1324	1864	465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c.exe	26

C:\Users\Admin\AppData\Local\Temp\465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c.exe
"C:\Users\Admin\AppData\Local\Temp\465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1772
  2⤵
  - Program crash
  PID:1324

memory/1864-54-0x0000000001300000-0x000000000130C000-memory.dmp

Filesize
48KB

Download
memory/1864-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download