purecrypter | 1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf

Analysis

max time kernel
133s
max time network
121s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-04-2023 11:01

Target

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe
Size

8KB
MD5

3f5bb951a818d19752d5a91d68ee8f83
SHA1

efba10de4b96360e0b6621c3110a1fffec0056dd
SHA256

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf
SHA512

ca2bc4a254111fa9fc86a1db5b6af9cee0d951bcd00f339e77c7e6ba8e86a52cdf452581fd2bfa5645633bd7f9f6b7d390732009a872d808fe2b509c9e58d15b
SSDEEP

96:9kjmjQAZDmqH/PMLBcaRZBdgsLmgskAhD1TIoD6DoKWZlWwuzNt:umjtNMLBFTZ1Go8KWZlW1

Score

10^/10

Family

purecrypter

http://80.66.75.36/p-Nzasgukzcp.dat

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

768 1692 WerFault.exe 1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

description pid process

Token: SeDebugPrivilege 1692 1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

pid	pid_target	process	target process
768	1692	WerFault.exe	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

description	pid	process
Token: SeDebugPrivilege	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

description	pid	process	target process
PID 1692 wrote to memory of 768	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe	WerFault.exe
PID 1692 wrote to memory of 768	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe	WerFault.exe
PID 1692 wrote to memory of 768	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe	WerFault.exe
PID 1692 wrote to memory of 768	1692	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 892
2⤵
- Program crash
PID:768

memory/1692-54-0x00000000010C0000-0x00000000010C8000-memory.dmp

Filesize
32KB

Download
memory/1692-55-0x0000000004F70000-0x0000000004FB0000-memory.dmp

Filesize
256KB

Download
memory/1692-56-0x0000000004F70000-0x0000000004FB0000-memory.dmp

Filesize
256KB

Download