risepro | bba27b344fc08c09bfbe8dd5abb3eb2c3bae68a7165390f662d693bfeaef0959

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 02:15

Target

2272-564-0x00000000013A0000-0x00000000018B6000-memory.exe
Size

5.1MB
MD5

048708313104fcf51751a3d8e1a4c8a9
SHA1

964a67eef47d4a326904dd724e70987f2ba6a326
SHA256

bba27b344fc08c09bfbe8dd5abb3eb2c3bae68a7165390f662d693bfeaef0959
SHA512

0eb7aa997ce838881b31bc52826f0bbcbeecdcea4cf088db3dff3a36f835b78c766fce6f7e0d803e44aa2765fac39ff551d18b47cbcccb61c1c10a5aff78ef55
SSDEEP

98304:9bBEbtlRAiBGHcJWcIPajNplModiwIU8:9bBEtlJEq2yZjuU

Score

10^/10

risepro stealer

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2156	1888	2272-564-0x00000000013A0000-0x00000000018B6000-memory.exe	28
PID 1888 wrote to memory of 2156	1888	2272-564-0x00000000013A0000-0x00000000018B6000-memory.exe	28
PID 1888 wrote to memory of 2156	1888	2272-564-0x00000000013A0000-0x00000000018B6000-memory.exe	28
PID 1888 wrote to memory of 2156	1888	2272-564-0x00000000013A0000-0x00000000018B6000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2272-564-0x00000000013A0000-0x00000000018B6000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2272-564-0x00000000013A0000-0x00000000018B6000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 36
  2⤵
  - Program crash
  PID:2156

memory/1888-0-0x00000000013A0000-0x00000000018B6000-memory.dmp

Filesize
5.1MB

Download