purecrypter | da24d44e4ab2b689a7fbcc940c69a4c81bd2708630eaec003da7f30634691ecd

Analysis

max time kernel
138s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:20

Target

53d520c1f12fe4e479c6e31626f7d4aba5a65d107c1a13401380ebca7cca5b05.exe
Size

76KB
MD5

99a0109485e8ca6d9ee2b809390d89b8
SHA1

ea89519b812adc5dff90531a6c64c987d6d109d8
SHA256

53d520c1f12fe4e479c6e31626f7d4aba5a65d107c1a13401380ebca7cca5b05
SHA512

5ec47bef15f1521c2cb5dc14a59c11dde14bd693f7df64991bb1268305eff03c8e0adc5fa6e2ddd6d5eecd1f9ac5c5ea0a90f4c6c6349348afb97a42a43fede8
SSDEEP

768:lw1QHHkyIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cf:l3tIULFMAAiu6JL6oNsgFAyox0cf

Score

10^/10

Family

purecrypter

https://store2.gofile.io/download/0283e6ba-afc6-4dcb-b2f4-3173d666e2c4/Huzeigtmvaplpinhoo.dll

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4796	5004	WerFault.exe	89

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

53d520c1f12fe4e479c6e31626f7d4aba5a65d107c1a13401380ebca7cca5b05.exe

description	pid	Process
Token: SeDebugPrivilege	5004	53d520c1f12fe4e479c6e31626f7d4aba5a65d107c1a13401380ebca7cca5b05.exe

C:\Users\Admin\AppData\Local\Temp\53d520c1f12fe4e479c6e31626f7d4aba5a65d107c1a13401380ebca7cca5b05.exe
"C:\Users\Admin\AppData\Local\Temp\53d520c1f12fe4e479c6e31626f7d4aba5a65d107c1a13401380ebca7cca5b05.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 1784
  2⤵
  - Program crash
  PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5004 -ip 5004
1⤵
PID:436

memory/5004-1-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/5004-0-0x0000000000F30000-0x0000000000F48000-memory.dmp

Filesize
96KB

Download
memory/5004-2-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/5004-3-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/5004-4-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download