purecrypter | 72230777bea3b7743dd098317f0761e2d609b345f96e5ff95e6ea13d3c14068a

Analysis

max time kernel
73s
max time network
65s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 14:31

Target

DHL DELIVERY INFORMATION_PDF.exe
Size

17KB
MD5

72d333e506d37d4669c41d8bbec9bc96
SHA1

0dc3ddf96b5ba5caec6b6643517fe68385abd150
SHA256

b7893446843d3e7293bc969fa52a2c7ecfe1bd1b83c5d9badaa0feb7d92be24f
SHA512

6914c75e240a4265b989740e69b283a0a4bbe357b07a1f6ade1b4757bce664e32c4d8e6e80b9075bbd3a2b8079727a2661383f74b0075b7ef28313f73170f7a1
SSDEEP

384:FMb8wRLeMj/CeKDQCkEKDVbJEp5KDGPGAC9:qbTa09mPGT

Score

10^/10

Family

purecrypter

https://onedrive.live.com/download?cid=BD9480D014FE52E5&resid=BD9480D014FE52E5%21386&authkey=AI3Byd9B8ZLvyCs

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
616	932	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	DHL DELIVERY INFORMATION_PDF.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 616	932	DHL DELIVERY INFORMATION_PDF.exe	27
PID 932 wrote to memory of 616	932	DHL DELIVERY INFORMATION_PDF.exe	27
PID 932 wrote to memory of 616	932	DHL DELIVERY INFORMATION_PDF.exe	27
PID 932 wrote to memory of 616	932	DHL DELIVERY INFORMATION_PDF.exe	27

C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY INFORMATION_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY INFORMATION_PDF.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 1776
  2⤵
  - Program crash
  PID:616

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7373.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
memory/932-54-0x0000000000D60000-0x0000000000D6A000-memory.dmp

Filesize
40KB

Download
memory/932-55-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/932-113-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download