purecrypter | 4e9bdfb5333105d8c8ebacb89c352372978eabdcd17f9a23094ac05c519a9b54

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 11:03

Target

Details.exe
Size

123KB
MD5

a6d253e02a22e26939f3d775ee1127cd
SHA1

a8e827a9c4916a4b85e5e783764173df0dadd116
SHA256

61722636c5cad31d212e7ea1da55d4fde3a7e93fc46f81484dd7597a684a8164
SHA512

dc13d3e6a721cc2673663d0b70fcae92ed2316f4b247039dcdf8e6312a0525fc14209c4c1f860da3d04939095f1f7a912d60b20f0242dbf6ff95bc341eaada82
SSDEEP

1536:cTCOJOQA7yTatlYBMcnAXqPprska5ayVD:cTnUyTatnEAaPpa5ayJ

Score

10^/10

Family

purecrypter

https://cdn.discordapp.com/attachments/897455876376522762/899558260732989531/File.png

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	1424	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1424	Details.exe

C:\Users\Admin\AppData\Local\Temp\Details.exe
"C:\Users\Admin\AppData\Local\Temp\Details.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 1744
  2⤵
  - Program crash
  PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1424 -ip 1424
1⤵
PID:3300

memory/1424-0-0x0000000000170000-0x0000000000196000-memory.dmp

Filesize
152KB

Download
memory/1424-1-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download
memory/1424-2-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/1424-3-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download
memory/1424-4-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download