risepro | ee877a4caec81c88ddd006c50a8196eadabe873cc6456ecf0d93150e839bc915

Analysis

max time kernel
149s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 21:23

Target

ee877a4caec81c88ddd006c50a8196eadabe873cc6456ecf0d93150e839bc915.exe
Size

900KB
MD5

65be3195b801d271e01d41f7bf576bd8
SHA1

9e20d649ee0884f8800ef67315caf56c7a6eaa03
SHA256

ee877a4caec81c88ddd006c50a8196eadabe873cc6456ecf0d93150e839bc915
SHA512

c84a1863aaece69b04beaccd20bf74b1f5bb691d8b401e8613bad717f5e5a94940e1b129b33ae3eb62e2d62ea988e904388f2e3b1ac35828b4441800facf6f4c
SSDEEP

24576:qqTm7F2KYgS5KTXxvmwT5aL4P8zre91t9olr:2FXO5KTXZJ0LOAatmr

Score

10^/10

risepro stealer

Family

risepro

147.45.47.93:58709

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	2480	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\ee877a4caec81c88ddd006c50a8196eadabe873cc6456ecf0d93150e839bc915.exe
"C:\Users\Admin\AppData\Local\Temp\ee877a4caec81c88ddd006c50a8196eadabe873cc6456ecf0d93150e839bc915.exe"
1⤵
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 608
  2⤵
  - Program crash
  PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2480 -ip 2480
1⤵
PID:2344

memory/2480-1-0x0000000004BD0000-0x0000000004C8D000-memory.dmp

Filesize
756KB

Download
memory/2480-2-0x0000000004C90000-0x0000000004DE8000-memory.dmp

Filesize
1.3MB

Download
memory/2480-3-0x0000000000400000-0x0000000002CC4000-memory.dmp

Filesize
40.8MB

Download
memory/2480-4-0x0000000000400000-0x0000000002CC4000-memory.dmp

Filesize
40.8MB

Download
memory/2480-5-0x0000000004BD0000-0x0000000004C8D000-memory.dmp

Filesize
756KB

Download
memory/2480-7-0x0000000004C90000-0x0000000004DE8000-memory.dmp

Filesize
1.3MB

Download