kinsing | 2e552c469f788abba6f6bac6a5e9f6d433eb54fa07b201c238605c05ecf1e92a

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:48

Target
2e552c469f788abba6f6bac6a5e9f6d433eb54fa07b201c238605c05ecf1e92a.dll
Size 2.3MB
Sample240125-s8ydwaaad3
SHA256 2e552c469f788abba6f6bac6a5e9f6d433eb54fa07b201c238605c05ecf1e92a
MD5 d87cb233aafe44e21bc158ac967dae8b
SHA1 2fd6c92b572fbfb2c90e076af3ec523dfa5796d3
SHA512 c2b613812b8bb56aebd61859d9c4080917d4e2a5928e4a1c502ba5358bf23ae9db9bcae655d59654666ac190634d5b2ec0575926b4bdceea913315c838ccd7ce
SSDEEP 24576:OfQ7GqLJJO7VZj6IK9MpYFI5iRkVE3nTjmBuTxt:OTqPIsFI5iRkVE3nTjmBuTxt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 540	2044	rundll32.exe	87
PID 2044 wrote to memory of 540	2044	rundll32.exe	87
PID 2044 wrote to memory of 540	2044	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e552c469f788abba6f6bac6a5e9f6d433eb54fa07b201c238605c05ecf1e92a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e552c469f788abba6f6bac6a5e9f6d433eb54fa07b201c238605c05ecf1e92a.dll,#1
  2⤵
  PID:540