purecrypter | aed0a4bc8a6c44e4c0ce77a39c34e6595865441031aec0473c09277a90913592

Analysis

max time kernel
23s
max time network
25s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-08-2024 21:51

Target

9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe
Size

67KB
MD5

9bc047adfeff396a16de8ad2a0c961dd
SHA1

0c556871050029a2ec53326655625767f82d1377
SHA256

aed0a4bc8a6c44e4c0ce77a39c34e6595865441031aec0473c09277a90913592
SHA512

319686f77a693212a31daddbb0c0dab68a04222a235e6ba7affed719cf3b770e47ddba07565cc24ffbaf6d1261532c0cc28c48c30e95affc6e029b1d60cbe1ca
SSDEEP

768:9mmXehf22v5H2Y0cYeFenyJrkcvPhOS4/Vi3xnehErtX+GsMw:EAehvHJ0cYeWQzPhOvVihneW9+V

Score

10^/10

Family

purecrypter

https://store2.gofile.io/download/96d02aa6-bb06-428e-a463-557e1bf9c1e2/Evoodujajdx.dll

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	3060	9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3060 wrote to memory of 2864	3060	9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe	31
PID 3060 wrote to memory of 2864	3060	9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe	31
PID 3060 wrote to memory of 2864	3060	9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9bc047adfeff396a16de8ad2a0c961dd_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3060 -s 1116
  2⤵
  PID:2864

memory/3060-0-0x000007FEF60D3000-0x000007FEF60D4000-memory.dmp

Filesize
4KB

Download
memory/3060-1-0x00000000009F0000-0x0000000000A04000-memory.dmp

Filesize
80KB

Download
memory/3060-2-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download
memory/3060-3-0x000007FEF60D3000-0x000007FEF60D4000-memory.dmp

Filesize
4KB

Download
memory/3060-4-0x000007FEF60D0000-0x000007FEF6ABC000-memory.dmp

Filesize
9.9MB

Download