purecrypter | 84fa72e64dbff9ed7dd9878f06a6754f2a670a6c75312247cee4840caa4d43c3

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-06-2023 11:06

Target

d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe
Size

8KB
MD5

7b9758cd62458a313f7140af848b6cb4
SHA1

97283124a0609be255e5a51711bbe5918d7e0ed1
SHA256

d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854
SHA512

530bf0cea2105a0b2955c0e0ca039431fba5ea541d1988abe78710c6db7f687cd5015ab4351411169d2c13e97f3ed13f23486a137e627645f0ef4ca6ab83996f
SSDEEP

192:Z8FPpr9eT8B6YZ7dY59wR/+1Sw3YWWEDwQWg:KRr9eT8Bii+1SlWWEDwQW

Score

10^/10

Family

purecrypter

http://80.66.75.37/Nwhxelt.mp3

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

676 1264 WerFault.exe d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

description pid process

Token: SeDebugPrivilege 1264 d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

pid	pid_target	process	target process
676	1264	WerFault.exe	d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

description	pid	process
Token: SeDebugPrivilege	1264	d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

description	pid	process	target process
PID 1264 wrote to memory of 676	1264	d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe	WerFault.exe
PID 1264 wrote to memory of 676	1264	d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe	WerFault.exe
PID 1264 wrote to memory of 676	1264	d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe	WerFault.exe
PID 1264 wrote to memory of 676	1264	d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe
"C:\Users\Admin\AppData\Local\Temp\d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1168
  2⤵
  - Program crash
  PID:676

memory/1264-54-0x0000000000A40000-0x0000000000A48000-memory.dmp

Filesize
32KB

Download
memory/1264-55-0x0000000004B20000-0x0000000004B60000-memory.dmp

Filesize
256KB

Download
memory/1264-56-0x0000000004B20000-0x0000000004B60000-memory.dmp

Filesize
256KB

Download