purecrypter | a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-10-2023 20:48

Target

NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe
Size

24KB
MD5

163c5014971669c1f95a0bf3af51eb9e
SHA1

c5d5453240579f3ea5ffc7573558d1d4d8046d95
SHA256

a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927
SHA512

80c0e037b1ae81fa56f170dbb83d8f8e7cb362d57c937af3a5f56cc6bd04d836812e1734d3cee8746aa09f3f2eb54c89a5b196eb6e3941a2c68ddb9d7e3a8dcd
SSDEEP

384:+tnekGIJA9Sd2i22i22222A222sf122WO22u02u26x2u2B+222u2R222u2ek22u4:tSVWxSHoCKbEMfnTbxBl

Score

10^/10

Family

purecrypter

https://cdn.discordapp.com/attachments/988727648014458883/988899741725257768/Gcosnd_Obqmhrws.bmp

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2800	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2660	2800	NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe	28
PID 2800 wrote to memory of 2660	2800	NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe	28
PID 2800 wrote to memory of 2660	2800	NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe	28
PID 2800 wrote to memory of 2660	2800	NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1036
  2⤵
  - Program crash
  PID:2660

memory/2800-0-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download
memory/2800-1-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/2800-2-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2800-3-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/2800-4-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download