purecrypter | ec9daf4a5bb14edd0e5437e8e9cddbe8952aa156f5619b9bed515ee078825fef

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 22:33

Target

fb2b2475b815a90a26002e2d0e264b1d5e18b0b76b4911a0ad68783e20a69840.exe
Size

6KB
MD5

b07d1f0141275eb6b6e35e948a5f63f1
SHA1

b047666885d54a5f59fa8dc3dd17d1097d3ae12b
SHA256

fb2b2475b815a90a26002e2d0e264b1d5e18b0b76b4911a0ad68783e20a69840
SHA512

c9e3dc67c81aa5da8724f29afec24a1ebac8e01d655acc8a5a4ea1efc01f094d3c8e115b127d1154308fdfc4c8da7f13a5b046e829153ee0ea561ec4d9a4ac22
SSDEEP

48:6a/UR7UC1rg7fpJfzw+2sF3YSFEO0IRC+ebPQKwb565VARX54tiOlXItqFDvpfbi:Yggrg7fm4oPIRCRsnbsVAYlI+BzNt

Score

10^/10

Family

purecrypter

http://80.66.76.30/Eryyhcchii.vdf

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	fb2b2475b815a90a26002e2d0e264b1d5e18b0b76b4911a0ad68783e20a69840.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 3048	2816	fb2b2475b815a90a26002e2d0e264b1d5e18b0b76b4911a0ad68783e20a69840.exe	28
PID 2816 wrote to memory of 3048	2816	fb2b2475b815a90a26002e2d0e264b1d5e18b0b76b4911a0ad68783e20a69840.exe	28
PID 2816 wrote to memory of 3048	2816	fb2b2475b815a90a26002e2d0e264b1d5e18b0b76b4911a0ad68783e20a69840.exe	28

C:\Users\Admin\AppData\Local\Temp\fb2b2475b815a90a26002e2d0e264b1d5e18b0b76b4911a0ad68783e20a69840.exe
"C:\Users\Admin\AppData\Local\Temp\fb2b2475b815a90a26002e2d0e264b1d5e18b0b76b4911a0ad68783e20a69840.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2816 -s 984
  2⤵
  PID:3048

memory/2816-0-0x0000000000A00000-0x0000000000A08000-memory.dmp

Filesize
32KB

Download
memory/2816-1-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/2816-2-0x000000001B620000-0x000000001B6A0000-memory.dmp

Filesize
512KB

Download
memory/2816-3-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/2816-4-0x000000001B620000-0x000000001B6A0000-memory.dmp

Filesize
512KB

Download