purecrypter | 1a4760e0f9e6c603749c0df65f48bfccc5a76476ed44b61dc0ea57cadb21a9e6

Analysis

max time kernel
76s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2023 12:24

Target

Payment_Confirmation_230721pdf.exe
Size

53KB
MD5

4feef1aae6a0fec7806c2c0fbbee297e
SHA1

2be923d8dc05abe584621a4bff5c9178cf43777a
SHA256

e03f7cbee9ba8443d200f1bcc47101185dcdc27b965b0ce9b650a0aae4c40492
SHA512

44c8d14b4543909e5f1451f25330f8d7a9679d12b2eaefab2c21dd8cf1d41491d1e41b00230a4cf36b5be63ba1b9721ce8c4ee07d0f802b5c284c6c655661a31
SSDEEP

768:qgyiRquYaRH/+MSlKphRUsSnDK3EaC8l2bP3SScNY8nfRqTuM+1+S:q1iRTYqNuKZUsgDK3EaqL36G8ETugS

Score

10^/10

Family

purecrypter

https://files.catbox.moe/730d8u.wav

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4832	100	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	100	Payment_Confirmation_230721pdf.exe

C:\Users\Admin\AppData\Local\Temp\Payment_Confirmation_230721pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_Confirmation_230721pdf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 1948
  2⤵
  - Program crash
  PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 100 -ip 100
1⤵
PID:4556

memory/100-133-0x0000000000F20000-0x0000000000F34000-memory.dmp

Filesize
80KB

Download
memory/100-134-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download
memory/100-135-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/100-136-0x0000000074B60000-0x0000000075310000-memory.dmp

Filesize
7.7MB

Download