kinsing | 21a29e142f495a8304547745a984023666a29b6e5c6b223b276ae1ce605c4bce

Analysis

max time kernel
95s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:47

Target

21a29e142f495a8304547745a984023666a29b6e5c6b223b276ae1ce605c4bce.dll
Size

150KB
MD5

4032fda8ce82e24a651c30e3a4bda1a8
SHA1

cf76215f13b37c11bd9eafbd5a085a202d4eef14
SHA256

21a29e142f495a8304547745a984023666a29b6e5c6b223b276ae1ce605c4bce
SHA512

7a2b828e9a6845e2031c19fa1d735a4da94b133f04cf4cb67afdbefbc9399ed14bc94d7f337b1952af2eb9bfed826b8aea0b160ae0ba7434b698d2e859ce9b32
SSDEEP

3072:PDzuh8iQGbKW8D6I/GrFOYPRz1H4mMN1q2ZJpPYrGzbzvQ2x4lOqZ:Huh8iQi4DZJpPHvzv749

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1000 wrote to memory of 4716	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 4716	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 4716	1000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21a29e142f495a8304547745a984023666a29b6e5c6b223b276ae1ce605c4bce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21a29e142f495a8304547745a984023666a29b6e5c6b223b276ae1ce605c4bce.dll,#1
2⤵
PID:4716