purecrypter | f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 05:47

Target

f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b.exe
Size

7KB
MD5

69a6b8a3793e0caa72ae7a4f4f577a83
SHA1

f23e10eea5fbc40ddabda04b3eb78c8382737001
SHA256

f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b
SHA512

7d0e2c507ab3fb3872b15d4d099212046120c98c64760d060a7dd3ea69e09856d0e62b615e7473344bcb62a8a3d9216ecfd6de2d0d7d33380b8f3d56209415db
SSDEEP

96:aYdC15aA2oo2JvOdrtv7KRo9zC6skJjgjZEkWrDSk1YdaKNp6Ny3EXzNt:p+vJJOrtv7KO5lsCAHWrDSwZyw

Score

10^/10

Family

purecrypter

https://onedrive.live.com/download?cid=B044AF3D48F7B886&resid=B044AF3D48F7B886%21118&authkey=AMf3wpfQszHiX6s

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2160	WerFault.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2672	2160	f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b.exe	31
PID 2160 wrote to memory of 2672	2160	f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b.exe	31
PID 2160 wrote to memory of 2672	2160	f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b.exe	31
PID 2160 wrote to memory of 2672	2160	f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b.exe	31

C:\Users\Admin\AppData\Local\Temp\f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b.exe
"C:\Users\Admin\AppData\Local\Temp\f92da20988e80b206c376f7241eb1af7c40df0c9f088fa0177828ca2f7746b4b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 1080
  2⤵
  - Program crash
  PID:2672

memory/2160-0-0x00000000741FE000-0x00000000741FF000-memory.dmp

Filesize
4KB

Download
memory/2160-1-0x00000000012B0000-0x00000000012B8000-memory.dmp

Filesize
32KB

Download
memory/2160-2-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2160-3-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download