purecrypter | b1c0b2b8c165b4144be04ac5138af82825f61f4928a4ddf8b9db44f3a2ba1e0d

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-02-2023 14:27

Target

$RECYCLE.BIN/$R40P23D.exe
Size

92KB
MD5

d40448b5ac56cf8f2a4bbea8d22982c2
SHA1

ad405a4f3ea892a80b696f7460de70bbb6b082f8
SHA256

d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc
SHA512

be9b6ffda6ebee70baa79bab24129150895bf5d06f0d634a1099e129bd63396c2f73e1c82115b6ca37df5aa5c406e3d1df2932e9a8dbeb927aacda727675082d
SSDEEP

384:IiZHmh0O/Lrw+Ke8QEoDeJisnDPnFw5sglcMhQM0u+GrCPHFYgMSXA:IgGhHzr8e8B1PnFusmcDCXrCPqEXA

Score

10^/10

Family

purecrypter

https://ashaambulanceservice.com/Vuzbri.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1392	2044	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	$R40P23D.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1392	2044	$R40P23D.exe	28
PID 2044 wrote to memory of 1392	2044	$R40P23D.exe	28
PID 2044 wrote to memory of 1392	2044	$R40P23D.exe	28
PID 2044 wrote to memory of 1392	2044	$R40P23D.exe	28

C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$R40P23D.exe
"C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$R40P23D.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 1344
  2⤵
  - Program crash
  PID:1392

memory/2044-54-0x0000000000020000-0x000000000003E000-memory.dmp

Filesize
120KB

Download
memory/2044-55-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2044-56-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download