purecrypter | a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23-10-2023 10:40

Target

163c5014971669c1f95a0bf3af51eb9e.exe
Size

24KB
MD5

163c5014971669c1f95a0bf3af51eb9e
SHA1

c5d5453240579f3ea5ffc7573558d1d4d8046d95
SHA256

a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927
SHA512

80c0e037b1ae81fa56f170dbb83d8f8e7cb362d57c937af3a5f56cc6bd04d836812e1734d3cee8746aa09f3f2eb54c89a5b196eb6e3941a2c68ddb9d7e3a8dcd
SSDEEP

384:+tnekGIJA9Sd2i22i22222A222sf122WO22u02u26x2u2B+222u2R222u2ek22u4:tSVWxSHoCKbEMfnTbxBl

Score

10^/10

Family

purecrypter

https://cdn.discordapp.com/attachments/988727648014458883/988899741725257768/Gcosnd_Obqmhrws.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	1824	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	163c5014971669c1f95a0bf3af51eb9e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2996	1824	163c5014971669c1f95a0bf3af51eb9e.exe	28
PID 1824 wrote to memory of 2996	1824	163c5014971669c1f95a0bf3af51eb9e.exe	28
PID 1824 wrote to memory of 2996	1824	163c5014971669c1f95a0bf3af51eb9e.exe	28
PID 1824 wrote to memory of 2996	1824	163c5014971669c1f95a0bf3af51eb9e.exe	28

C:\Users\Admin\AppData\Local\Temp\163c5014971669c1f95a0bf3af51eb9e.exe
"C:\Users\Admin\AppData\Local\Temp\163c5014971669c1f95a0bf3af51eb9e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 1020
  2⤵
  - Program crash
  PID:2996

memory/1824-1-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1824-0-0x00000000009A0000-0x00000000009AC000-memory.dmp

Filesize
48KB

Download
memory/1824-2-0x00000000001C0000-0x0000000000200000-memory.dmp

Filesize
256KB

Download
memory/1824-3-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1824-4-0x00000000001C0000-0x0000000000200000-memory.dmp

Filesize
256KB

Download