risepro | 10afe3408065d1a488e82d405027eb6c0ca9ca227a42931e9fffb716a256b6e5

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 00:37

Target
4716-2-0x0000000000EB0000-0x0000000001650000-memory.exe
Size 7.6MB
Sample240408-aynsksbd91
SHA256 10afe3408065d1a488e82d405027eb6c0ca9ca227a42931e9fffb716a256b6e5
MD5 f5f3449d7974a20e8671d54ba9b4bf00
SHA1 02c0c7a73c8c3c50b097001c359f7025e3d3f6c6
SHA512 242094bb6a8e3d2a692a23bf062f66b785fbb71d57ad0e1696b5d1bde70b3e3aaadef362c996e8fa2c406b9ebe9b8f977b5991230966b8d82742fd31184d0ca4
SSDEEP 196608:wzfhuF8w75Z/Pvq5mfwgbMLYA604JDeY:Wuyw7X/nwmYg1b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/1624-0-0x0000000000190000-0x0000000000930000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5112	1624	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\4716-2-0x0000000000EB0000-0x0000000001650000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4716-2-0x0000000000EB0000-0x0000000001650000-memory.exe"
1⤵
PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 224
  2⤵
  - Program crash
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1624 -ip 1624
1⤵
PID:488

memory/1624-0-0x0000000000190000-0x0000000000930000-memory.dmp

Download