kinsing | 0463b4e565fdeeb1511beea6e9d152ec3939298c20fdef976a52c1d8b5ecdfb0

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:44

Target

$PLUGINSDIR/TkNsweb.dll
Size

59KB
MD5

c6731fd774db4835a5763afd404a50eb
SHA1

c6b20b36631b513ca8647d952b95469b77d2ac24
SHA256

23861a8828cedc363baa54760766c01fdd9e1414073ca1148ff9a19ca818b13a
SHA512

c3eca3f693f4ff6b078e0708c70156f2184708f0e07d40f3cd54dd24556ae6e010a89b9bfb777f4131f0d0ee0f87d79015e7eb8f0b2606fa156d846dd581e197
SSDEEP

768:LGGFsrrp6e7co2DLJUcUw9nf/bsJVtCcdWANKDrYsWjcdvCQFEzLr+M4dk:LGdNRIrLJUBwZUvCcdgYsWjcdqQdvk

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3212 3812 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3212	3812	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 3812	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 3812	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 3812	1400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TkNsweb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TkNsweb.dll,#1
2⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 664
3⤵
- Program crash
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3812 -ip 3812
1⤵
PID:1452