purecrypter | 84fa72e64dbff9ed7dd9878f06a6754f2a670a6c75312247cee4840caa4d43c3

Analysis

max time kernel
84s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2023 11:06

Target

d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe
Size

8KB
MD5

7b9758cd62458a313f7140af848b6cb4
SHA1

97283124a0609be255e5a51711bbe5918d7e0ed1
SHA256

d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854
SHA512

530bf0cea2105a0b2955c0e0ca039431fba5ea541d1988abe78710c6db7f687cd5015ab4351411169d2c13e97f3ed13f23486a137e627645f0ef4ca6ab83996f
SSDEEP

192:Z8FPpr9eT8B6YZ7dY59wR/+1Sw3YWWEDwQWg:KRr9eT8Bii+1SlWWEDwQW

Score

10^/10

Family

purecrypter

http://80.66.75.37/Nwhxelt.mp3

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4248 536 WerFault.exe d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

description pid process

Token: SeDebugPrivilege 536 d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

pid	pid_target	process	target process
4248	536	WerFault.exe	d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

description	pid	process
Token: SeDebugPrivilege	536	d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe

C:\Users\Admin\AppData\Local\Temp\d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe
"C:\Users\Admin\AppData\Local\Temp\d208590c79da86b985cc59520cd3c771c2b8e2e3987a0914534fd3dc1f83a854.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 1660
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 536 -ip 536
1⤵
PID:3308

memory/536-133-0x0000000000900000-0x0000000000908000-memory.dmp

Filesize
32KB

Download
memory/536-134-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download