risepro | baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 04:43

Target

c72e70f29d3dd8fa148df55e8e6dec43.exe
Size

1.8MB
MD5

c72e70f29d3dd8fa148df55e8e6dec43
SHA1

2f182d43528f78d6d847b37b77da9a09a2ed1f0a
SHA256

baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b
SHA512

d1923e33057413d478daaaaa54bb157762172a58ae03fc36e0c1c6e4d64c0c33d08bff7aec8759f533331215960d739fec2ffea86d18d1d8a70105927a6a5f12
SSDEEP

49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i

Score

10^/10

risepro stealer

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	868	WerFault.exe	80

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	81

C:\Users\Admin\AppData\Local\Temp\c72e70f29d3dd8fa148df55e8e6dec43.exe
"C:\Users\Admin\AppData\Local\Temp\c72e70f29d3dd8fa148df55e8e6dec43.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 304
  2⤵
  - Program crash
  PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 868 -ip 868
1⤵
PID:1800

memory/868-0-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/4964-1-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/4964-2-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/4964-5-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/4964-4-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download