purecrypter | b1c0b2b8c165b4144be04ac5138af82825f61f4928a4ddf8b9db44f3a2ba1e0d

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-02-2023 14:27

Target

$RECYCLE.BIN/$R40P23D.exe
Size

92KB
MD5

d40448b5ac56cf8f2a4bbea8d22982c2
SHA1

ad405a4f3ea892a80b696f7460de70bbb6b082f8
SHA256

d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc
SHA512

be9b6ffda6ebee70baa79bab24129150895bf5d06f0d634a1099e129bd63396c2f73e1c82115b6ca37df5aa5c406e3d1df2932e9a8dbeb927aacda727675082d
SSDEEP

384:IiZHmh0O/Lrw+Ke8QEoDeJisnDPnFw5sglcMhQM0u+GrCPHFYgMSXA:IgGhHzr8e8B1PnFusmcDCXrCPqEXA

Score

10^/10

Family

purecrypter

https://ashaambulanceservice.com/Vuzbri.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1392 2044 WerFault.exe $R40P23D.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

$R40P23D.exe

description pid process

Token: SeDebugPrivilege 2044 $R40P23D.exe

pid	pid_target	process	target process
1392	2044	WerFault.exe	$R40P23D.exe

description	pid	process
Token: SeDebugPrivilege	2044	$R40P23D.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

$R40P23D.exe

description	pid	process	target process
PID 2044 wrote to memory of 1392	2044	$R40P23D.exe	WerFault.exe
PID 2044 wrote to memory of 1392	2044	$R40P23D.exe	WerFault.exe
PID 2044 wrote to memory of 1392	2044	$R40P23D.exe	WerFault.exe
PID 2044 wrote to memory of 1392	2044	$R40P23D.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 1344
2⤵
- Program crash
PID:1392

memory/2044-54-0x0000000000020000-0x000000000003E000-memory.dmp

Filesize
120KB

Download
memory/2044-55-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/2044-56-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download