purecrypter | 47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d

Analysis

max time kernel
125s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2023 11:03

Target

47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe
Size

23KB
MD5

4a5b45207512b2f4ee3bd8cd7a25ba9e
SHA1

2700be565b25a627c86adf20798e90e99958a3ea
SHA256

47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d
SHA512

a1e26da024c534083fde7dee2846973489ceb06c536a751bde47fa74977efe5ab3762bd8f82bc427800eb43ee9e56064dcbd755d00454c2be112cdd04eb2e4ce
SSDEEP

384:YbrFmwPzQHzVZJq/S8frSo62tCT+UuSvwiFawG:Ah2HzIfrS8fiFa/

Score

10^/10

Family

purecrypter

https://onedrive.live.com/download?cid=BD9480D014FE52E5&resid=BD9480D014FE52E5%21385&authkey=AB7WYGSbxFgcTyw

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4548 1132 WerFault.exe 47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe

description pid process

Token: SeDebugPrivilege 1132 47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe

pid	pid_target	process	target process
4548	1132	WerFault.exe	47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe

description	pid	process
Token: SeDebugPrivilege	1132	47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe

C:\Users\Admin\AppData\Local\Temp\47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe
"C:\Users\Admin\AppData\Local\Temp\47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 1992
2⤵
- Program crash
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1132 -ip 1132
1⤵
PID:1368

memory/1132-133-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/1132-134-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/1132-135-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download