risepro | 22ae3cc817980cdcfd92cb78896172f482dda0cc4673bb171888b4ff62a3c94c

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 07:43

Target
1616-1-0x00000000003D0000-0x00000000008E4000-memory.exe
Size 5.1MB
Sample240403-jklkqsaf4w
SHA256 22ae3cc817980cdcfd92cb78896172f482dda0cc4673bb171888b4ff62a3c94c
MD5 639fb02c67d9d26f9dfdfb91ab41bc0c
SHA1 7c97ba5a0273416ba12720e2ed4ec2e8d26afa4d
SHA512 4b68becd80132727fa703dace030913dd64bde249918863bb183032da11a5b791800865ddf50a99de7098b8aa105a392d942fc4ef9ae44bcb00d769451348fec
SSDEEP 98304:/+FnFMpSCUOqVXyURnIvefQuQkbYUKT3aXMymxV7T/:GjMpSCgiUKTCMymxFT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro stealer

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Program crash 1 IoCs

pid	pid_target	Process	procid_target
756	4296	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\1616-1-0x00000000003D0000-0x00000000008E4000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1616-1-0x00000000003D0000-0x00000000008E4000-memory.exe"
1⤵
PID:4296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 216
  2⤵
  - Program crash
  PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4296 -ip 4296
1⤵
PID:1700

memory/4296-0-0x0000000000E50000-0x0000000001364000-memory.dmp

Download