purecrypter | 47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d

Analysis

max time kernel
72s
max time network
63s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-02-2023 07:26

Target

file.exe
Size

23KB
MD5

4a5b45207512b2f4ee3bd8cd7a25ba9e
SHA1

2700be565b25a627c86adf20798e90e99958a3ea
SHA256

47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d
SHA512

a1e26da024c534083fde7dee2846973489ceb06c536a751bde47fa74977efe5ab3762bd8f82bc427800eb43ee9e56064dcbd755d00454c2be112cdd04eb2e4ce
SSDEEP

384:YbrFmwPzQHzVZJq/S8frSo62tCT+UuSvwiFawG:Ah2HzIfrS8fiFa/

Score

10^/10

Family

purecrypter

https://onedrive.live.com/download?cid=BD9480D014FE52E5&resid=BD9480D014FE52E5%21385&authkey=AB7WYGSbxFgcTyw

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1332	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 1912	1332	file.exe	28
PID 1332 wrote to memory of 1912	1332	file.exe	28
PID 1332 wrote to memory of 1912	1332	file.exe	28
PID 1332 wrote to memory of 1912	1332	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1824
  2⤵
  - Program crash
  PID:1912

memory/1332-54-0x00000000010B0000-0x00000000010BC000-memory.dmp

Filesize
48KB

Download
memory/1332-55-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download