purecrypter | 1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf

Analysis

max time kernel
133s
max time network
121s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-04-2023 11:01

Target

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe
Size

8KB
MD5

3f5bb951a818d19752d5a91d68ee8f83
SHA1

efba10de4b96360e0b6621c3110a1fffec0056dd
SHA256

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf
SHA512

ca2bc4a254111fa9fc86a1db5b6af9cee0d951bcd00f339e77c7e6ba8e86a52cdf452581fd2bfa5645633bd7f9f6b7d390732009a872d808fe2b509c9e58d15b
SSDEEP

96:9kjmjQAZDmqH/PMLBcaRZBdgsLmgskAhD1TIoD6DoKWZlWwuzNt:umjtNMLBFTZ1Go8KWZlW1

Score

10^/10

Family

purecrypter

http://80.66.75.36/p-Nzasgukzcp.dat

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
768	1692	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 768	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe	28
PID 1692 wrote to memory of 768	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe	28
PID 1692 wrote to memory of 768	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe	28
PID 1692 wrote to memory of 768	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe	28

C:\Users\Admin\AppData\Local\Temp\1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe
"C:\Users\Admin\AppData\Local\Temp\1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 892
  2⤵
  - Program crash
  PID:768

memory/1692-54-0x00000000010C0000-0x00000000010C8000-memory.dmp

Filesize
32KB

Download
memory/1692-55-0x0000000004F70000-0x0000000004FB0000-memory.dmp

Filesize
256KB

Download
memory/1692-56-0x0000000004F70000-0x0000000004FB0000-memory.dmp

Filesize
256KB

Download