purecrypter | d025de2270726010f47d46700b40bf9e1b61daf655f1b43ed5e7b50ecf89751a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
31-08-2024 05:00

Target

b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29.exe
Size

12KB
MD5

b082437e6c30747af43f9e9ce795e17a
SHA1

30759f7e545f2d80ff8d51c8e07c83c1452851cf
SHA256

b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29
SHA512

7a127819d90d468c913f160a05c6a550df5f5374684d0e7b5ddcea038c2fae8203a676d8eee0e163e93d6628253ac4e9c790b6442bbfde35a411066ae69b65d4
SSDEEP

192:Rd+SoL+WA4g2sLhMGmcNSdG/I3YzWYEI5lzfg/DvQbE:SSoSWAD2wy/I2G/I3YzWlI5lTiob

Score

10^/10

Family

purecrypter

http://37.0.8.173/conhost-l.png

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2888	2136	b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29.exe	31
PID 2136 wrote to memory of 2888	2136	b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29.exe	31
PID 2136 wrote to memory of 2888	2136	b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29.exe	31

C:\Users\Admin\AppData\Local\Temp\b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29.exe
"C:\Users\Admin\AppData\Local\Temp\b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 1068
  2⤵
  PID:2888

memory/2136-0-0x000007FEF5F73000-0x000007FEF5F74000-memory.dmp

Filesize
4KB

Download
memory/2136-1-0x000000013FD10000-0x000000013FD18000-memory.dmp

Filesize
32KB

Download
memory/2136-2-0x000007FEF5F73000-0x000007FEF5F74000-memory.dmp

Filesize
4KB

Download
memory/2136-3-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/2136-4-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download