purecrypter | a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 10:40

Target

163c5014971669c1f95a0bf3af51eb9e.exe
Size

24KB
MD5

163c5014971669c1f95a0bf3af51eb9e
SHA1

c5d5453240579f3ea5ffc7573558d1d4d8046d95
SHA256

a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927
SHA512

80c0e037b1ae81fa56f170dbb83d8f8e7cb362d57c937af3a5f56cc6bd04d836812e1734d3cee8746aa09f3f2eb54c89a5b196eb6e3941a2c68ddb9d7e3a8dcd
SSDEEP

384:+tnekGIJA9Sd2i22i22222A222sf122WO22u02u26x2u2B+222u2R222u2ek22u4:tSVWxSHoCKbEMfnTbxBl

Score

10^/10

Family

purecrypter

https://cdn.discordapp.com/attachments/988727648014458883/988899741725257768/Gcosnd_Obqmhrws.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1152	1352	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	163c5014971669c1f95a0bf3af51eb9e.exe

C:\Users\Admin\AppData\Local\Temp\163c5014971669c1f95a0bf3af51eb9e.exe
"C:\Users\Admin\AppData\Local\Temp\163c5014971669c1f95a0bf3af51eb9e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 1716
  2⤵
  - Program crash
  PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1352 -ip 1352
1⤵
PID:2724

memory/1352-0-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/1352-1-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/1352-2-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Filesize
64KB

Download
memory/1352-3-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download