risepro | 4c8530162bcf427ffe57b671f9597e84d8258ddfd71f4b812e54efffa1d2a198

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 12:01

Target

1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe
Size

5.1MB
MD5

7e322c968d00d022b6599878b6517ef4
SHA1

687710162cda282cdbbe3c3e5ff4ca54d1f474ec
SHA256

4c8530162bcf427ffe57b671f9597e84d8258ddfd71f4b812e54efffa1d2a198
SHA512

29e4caeda5f0ed3225820702b60ec2f7fbfa637592a6d34ec607be4a2a5886b929a93345cd7e449530e4490c5a579e4d18fe751c5802acaa471d0d2c7f275dde
SSDEEP

49152:E4BGbe8JG9nqVotiW9hsTwCTP8o1Cl8seSByjSYaNbTKIP3apQrD3fReNjXdbFCr:hBp8JGM7W9fByriCIiitsjNpdtfc

Score

10^/10

risepro stealer

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1104 1160 WerFault.exe 1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe

pid	pid_target	process	target process
1104	1160	WerFault.exe	1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe

description	pid	process	target process
PID 1160 wrote to memory of 1104	1160	1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe	WerFault.exe
PID 1160 wrote to memory of 1104	1160	1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe	WerFault.exe
PID 1160 wrote to memory of 1104	1160	1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe	WerFault.exe
PID 1160 wrote to memory of 1104	1160	1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1008-2-0x00000000001E0000-0x00000000006F6000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 36
2⤵
- Program crash
PID:1104

memory/1160-0-0x00000000001E0000-0x00000000006F6000-memory.dmp

Filesize
5.1MB

Download