risepro | baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 04:43

Target

c72e70f29d3dd8fa148df55e8e6dec43.exe
Size

1.8MB
MD5

c72e70f29d3dd8fa148df55e8e6dec43
SHA1

2f182d43528f78d6d847b37b77da9a09a2ed1f0a
SHA256

baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b
SHA512

d1923e33057413d478daaaaa54bb157762172a58ae03fc36e0c1c6e4d64c0c33d08bff7aec8759f533331215960d739fec2ffea86d18d1d8a70105927a6a5f12
SSDEEP

49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i

Score

10^/10

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Suspicious use of SetThreadContext 1 IoCs

Processes:

c72e70f29d3dd8fa148df55e8e6dec43.exe

description pid process target process

PID 868 set thread context of 4964 868 c72e70f29d3dd8fa148df55e8e6dec43.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2680 868 WerFault.exe c72e70f29d3dd8fa148df55e8e6dec43.exe

description	pid	process	target process
PID 868 set thread context of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe

pid	pid_target	process	target process
2680	868	WerFault.exe	c72e70f29d3dd8fa148df55e8e6dec43.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

c72e70f29d3dd8fa148df55e8e6dec43.exe

description	pid	process	target process
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe
PID 868 wrote to memory of 4964	868	c72e70f29d3dd8fa148df55e8e6dec43.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 304
2⤵
- Program crash
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 868 -ip 868
1⤵
PID:1800

memory/868-0-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/4964-1-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/4964-2-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/4964-5-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download
memory/4964-4-0x0000000000400000-0x0000000000596000-memory.dmp

Filesize
1.6MB

Download