purecrypter | 034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-03-2023 02:54

Target

034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7.exe
Size

15KB
MD5

cf6f2f6fd2c10a069000d167b411436c
SHA1

ae635338bba2673debcf2b0f1113471637501a11
SHA256

034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7
SHA512

c7448c689f0d41782c5cbfdaa7fcc22404efcd12e5be5890d12b79c28f3cd02844eb6470ac67333f117242d471dd32341b1ebd5b0e75bc8a1b96eb46c72e8828
SSDEEP

192:UUaOTYEveSX5KHl0lZF1DvqKK5yqAq/m9GIhRCMGNMlT1yL+nLL4a:YOTBBX4F0lZFpSKUs/IlP+n/4

Score

10^/10

Family

purecrypter

http://104.168.45.20/Bepvztnul.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
988	1808	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 988	1808	034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7.exe	28
PID 1808 wrote to memory of 988	1808	034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7.exe	28
PID 1808 wrote to memory of 988	1808	034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7.exe	28
PID 1808 wrote to memory of 988	1808	034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7.exe	28

C:\Users\Admin\AppData\Local\Temp\034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7.exe
"C:\Users\Admin\AppData\Local\Temp\034a1dfbf4a48be349bb1da32f5ce96bf0719cdad33508fbd13e1ca67d3852b7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1052
  2⤵
  - Program crash
  PID:988

memory/1808-54-0x00000000013D0000-0x00000000013DA000-memory.dmp

Filesize
40KB

Download
memory/1808-55-0x00000000004A0000-0x00000000004E0000-memory.dmp

Filesize
256KB

Download
memory/1808-56-0x00000000004A0000-0x00000000004E0000-memory.dmp

Filesize
256KB

Download