risepro | 0a230b0097196f0a609fb2562f0042de8f10992eb25bc66d1aaeb2e5783b2ec4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 20:25

Target

3532-1630-0x0000000000210000-0x0000000000727000-memory.exe
Size

5.1MB
MD5

139de6202b96c84cb24e199d41cbdd9d
SHA1

e28bdd1590f71c925e1e81a853ac3cec4348d2bf
SHA256

0a230b0097196f0a609fb2562f0042de8f10992eb25bc66d1aaeb2e5783b2ec4
SHA512

36f05f6138e3404fddcc3fe2311dc9267953ab6146bbf31b6a88baccac411a37563c24abdec7bd1f3b3f2df0a1e2958803569d385fac275d2af73f02a7af9fb0
SSDEEP

98304:RjNMxpbLoUbvXs43hosIaM6fLBy0R52kwUEnjQADW:RjNypbvjh4h6fLByYqXW

Score

10^/10

risepro stealer

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Program crash 1 IoCs

pid	pid_target	Process
2848	2736	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2848	2736	3532-1630-0x0000000000210000-0x0000000000727000-memory.exe	16
PID 2736 wrote to memory of 2848	2736	3532-1630-0x0000000000210000-0x0000000000727000-memory.exe	16
PID 2736 wrote to memory of 2848	2736	3532-1630-0x0000000000210000-0x0000000000727000-memory.exe	16
PID 2736 wrote to memory of 2848	2736	3532-1630-0x0000000000210000-0x0000000000727000-memory.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 36
1⤵
- Program crash
PID:2848

C:\Users\Admin\AppData\Local\Temp\3532-1630-0x0000000000210000-0x0000000000727000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3532-1630-0x0000000000210000-0x0000000000727000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736

memory/2736-0-0x0000000000210000-0x0000000000727000-memory.dmp

Filesize
5.1MB

Download