purecrypter | 89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3

Analysis

max time kernel
127s
max time network
110s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-04-2023 11:04

Target

89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3.exe
Size

13KB
MD5

2a8ec78e40f559755b9eab2956e4501b
SHA1

c1879635e45a16dd02990d9c406e08d84c76b4cc
SHA256

89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3
SHA512

eefa794ac53f3735cb236a413209d5e4cd05c52ea6d10903168a3e1cb4859fcafcf853a97cbc96698b6bbc9bbfd0db965f7d59e3d746b996c16bd4e02e0c95d7
SSDEEP

384:ThwZHmojG4Z5LNOFvPfWo1te/EyHg3WXHjCWn:TheGo/N0PJ15g7

Score

10^/10

Family

purecrypter

http://80.66.75.36/a-Bwypfg.png

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	1948	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1904	1948	89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3.exe	28
PID 1948 wrote to memory of 1904	1948	89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3.exe	28
PID 1948 wrote to memory of 1904	1948	89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3.exe	28
PID 1948 wrote to memory of 1904	1948	89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3.exe	28

C:\Users\Admin\AppData\Local\Temp\89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3.exe
"C:\Users\Admin\AppData\Local\Temp\89596573ac84cbb4b36e85f1d928cb6c953bd17a034f06162a4386cce8fce8e3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 1028
  2⤵
  - Program crash
  PID:1904

memory/1948-54-0x0000000000C00000-0x0000000000C0A000-memory.dmp

Filesize
40KB

Download
memory/1948-55-0x0000000002100000-0x0000000002140000-memory.dmp

Filesize
256KB

Download
memory/1948-56-0x0000000002100000-0x0000000002140000-memory.dmp

Filesize
256KB

Download