purecrypter | 9778c6d49c3ab49c7fd8c4bbbffd5e16aeca9ee0074a9c0854a55adde768e03e

Analysis

max time kernel
116s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2023, 16:06

Target
file.exe
Size 195KB
Sample230218-tkcmyacb21
SHA256 9778c6d49c3ab49c7fd8c4bbbffd5e16aeca9ee0074a9c0854a55adde768e03e
MD5 b9242c8c1b0d0beb00c9d67a20e85c73
SHA1 43592d357c784c64b4182f7d04f293738ea8e848
SHA512 e627268ac515cfeadcb44d6bd39c636855d94d523e31362be414b0245cb45cf2def518cadb656db894d54af50d95bd5e73b68f87c34fcbf9dd2c9b033a8d9693
SSDEEP 1536:fLMoVToraIlrxCka52oXKsuWoZxX6zaTlz5vF:fLMoFsVK2OKsuWoZxqaz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4476	4460	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1712
  2⤵
  - Program crash
  PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4460 -ip 4460
1⤵
PID:5020

memory/4460-132-0x00000000003A0000-0x00000000003D2000-memory.dmp

Download

memory/4460-133-0x0000000005400000-0x00000000059A4000-memory.dmp

Download

memory/4460-134-0x0000000004D70000-0x0000000004E02000-memory.dmp

Download