kinsing | e5375a1b2add17252046a96617a4226027919f4b8a094755e156b2df05d33d4a

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:45

Target

e5375a1b2add17252046a96617a4226027919f4b8a094755e156b2df05d33d4a.dll
Size

2.6MB
MD5

f2303e01c8bca22c26b6b54459c7b223
SHA1

be2bfda5b99c34548f47992ff4a33269f48331bd
SHA256

e5375a1b2add17252046a96617a4226027919f4b8a094755e156b2df05d33d4a
SHA512

082a3e22aff1376ab6d1b9ad1b8e11d8b05d4106fcaf19c2973014d9b1b2ef820eb416c4fe92503a97599fffd4432cdddac39d3365d845f36c95751ad9098166
SSDEEP

49152:8HmxzufYx2rnDlkxIKSI4Mjg6oF47dYc9D56cv93GzPTHGo8KXkVezuHyhv9aQkt:zzufYOnDlkxIKSI4Mjg6oF47dYc9D56R

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 884 wrote to memory of 3728	884	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 3728	884	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 3728	884	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5375a1b2add17252046a96617a4226027919f4b8a094755e156b2df05d33d4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5375a1b2add17252046a96617a4226027919f4b8a094755e156b2df05d33d4a.dll,#1
2⤵
PID:3728