purecrypter | 9778c6d49c3ab49c7fd8c4bbbffd5e16aeca9ee0074a9c0854a55adde768e03e

Analysis

max time kernel
74s
max time network
78s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/02/2023, 16:06

Target
file.exe
Size 195KB
Sample230218-tkcmyacb21
SHA256 9778c6d49c3ab49c7fd8c4bbbffd5e16aeca9ee0074a9c0854a55adde768e03e
MD5 b9242c8c1b0d0beb00c9d67a20e85c73
SHA1 43592d357c784c64b4182f7d04f293738ea8e848
SHA512 e627268ac515cfeadcb44d6bd39c636855d94d523e31362be414b0245cb45cf2def518cadb656db894d54af50d95bd5e73b68f87c34fcbf9dd2c9b033a8d9693
SSDEEP 1536:fLMoVToraIlrxCka52oXKsuWoZxX6zaTlz5vF:fLMoFsVK2OKsuWoZxqaz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
988	956	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 988	956	file.exe	27
PID 956 wrote to memory of 988	956	file.exe	27
PID 956 wrote to memory of 988	956	file.exe	27
PID 956 wrote to memory of 988	956	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 1300
  2⤵
  - Program crash
  PID:988

memory/956-54-0x0000000000FD0000-0x0000000001002000-memory.dmp

Download

memory/956-55-0x0000000076561000-0x0000000076563000-memory.dmp

Download