risepro | 0f88ea51a56da966d12311a4b20ea3a6c44315e00747a589f19cf535f90ced77

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 07:15

Target

97768ab0a4837757b74de2ae892badab.exe
Size

1.8MB
MD5

97768ab0a4837757b74de2ae892badab
SHA1

d8bdfdb717b64ee4cd7a892bbddd293f7eaf915c
SHA256

0f88ea51a56da966d12311a4b20ea3a6c44315e00747a589f19cf535f90ced77
SHA512

78bc5c866b12fcc82cdda20622694824b227a4d522632ffca4b6608bb5245a5e39c28e7f10dfd9e253407a922dae47a83171fb3f605597af4f7186c3aaf5dcde
SSDEEP

49152:Ktx9fJc02euDyRs7NNvZpFW3wrqirfHWZjlavwpX:Ktx9fe02beG5Nv+w+irHWZjlavwpX

Score

10^/10

risepro stealer

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 728 set thread context of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	728	WerFault.exe	79

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81
PID 728 wrote to memory of 1204	728	97768ab0a4837757b74de2ae892badab.exe	81

C:\Users\Admin\AppData\Local\Temp\97768ab0a4837757b74de2ae892badab.exe
"C:\Users\Admin\AppData\Local\Temp\97768ab0a4837757b74de2ae892badab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 136
  2⤵
  - Program crash
  PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 728 -ip 728
1⤵
PID:4816

memory/728-1-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1204-0-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1204-2-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1204-3-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/1204-5-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download