How can I find out which process was stopped by RansomWhere?
According to RansomWhere's own site the data is stored in 


/Library/RansomWhere/installedApps.plist - a list of applications already present on the system.  
/Library/RansomWhere/approvedBinaries.plist - a list of binaries explicitly approved by the user.  
/Library/RansomWhere/whitelist.plist - a list of safe binaries (that often legitimately create encrypted files).  
/Library/RansomWhere/graylist.plist - a list of system binaries that are not explicitly trusted.  


However, because an app that was terminated is by design not remembered, it will not appear in any list.


  The following list summarizes the 'allow' and 'terminate' actions  
  
  
  'allow'   Tells RansomWhere? it's ok to let the process continue running. This will be persistently remembered; you'll never be alerted
  about this binary again.
  'terminate'   Tells RansomWhere? to kill the process. As this action is a little more drastic, RansomWhere?, (by design) will not remember
  such actions. Thus if the terminated process is ran again, it will
  cause another alert.
  


You could check Console to see whether it generated an event at the time - I can't test that as I've never run RansomWhere.