purecrypter | 1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf

Analysis

max time kernel
166s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2023 11:01

Target

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe
Size

8KB
MD5

3f5bb951a818d19752d5a91d68ee8f83
SHA1

efba10de4b96360e0b6621c3110a1fffec0056dd
SHA256

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf
SHA512

ca2bc4a254111fa9fc86a1db5b6af9cee0d951bcd00f339e77c7e6ba8e86a52cdf452581fd2bfa5645633bd7f9f6b7d390732009a872d808fe2b509c9e58d15b
SSDEEP

96:9kjmjQAZDmqH/PMLBcaRZBdgsLmgskAhD1TIoD6DoKWZlWwuzNt:umjtNMLBFTZ1Go8KWZlW1

Score

10^/10

Family

purecrypter

http://80.66.75.36/p-Nzasgukzcp.dat

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3904 2856 WerFault.exe 1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

description pid process

Token: SeDebugPrivilege 2856 1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

pid	pid_target	process	target process
3904	2856	WerFault.exe	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

description	pid	process
Token: SeDebugPrivilege	2856	1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe

C:\Users\Admin\AppData\Local\Temp\1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe
"C:\Users\Admin\AppData\Local\Temp\1012a0693246fceec2ec5ae8265e6ddf9b4881acbc1a452df519f18a9083eddf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 1452
2⤵
- Program crash
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2856 -ip 2856
1⤵
PID:892

memory/2856-133-0x0000000000E80000-0x0000000000E88000-memory.dmp

Filesize
32KB

Download
memory/2856-134-0x0000000003390000-0x00000000033A0000-memory.dmp

Filesize
64KB

Download
memory/2856-135-0x0000000003390000-0x00000000033A0000-memory.dmp

Filesize
64KB

Download