kinsing | 97f00241952bb3f1ede142afbd36c902622faf421ff75f2bfd945d63c143c8b7

Analysis

max time kernel
90s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:51

Target
97f00241952bb3f1ede142afbd36c902622faf421ff75f2bfd945d63c143c8b7.dll
Size 2.3MB
Sample240125-taf8dabaam
SHA256 97f00241952bb3f1ede142afbd36c902622faf421ff75f2bfd945d63c143c8b7
MD5 35b2a14f4100c7a1cb98f85b7cc9d8e3
SHA1 3df613adc29283d2f2d1463bbbb0b4561b609d99
SHA512 0ab23c349ed79618ffe73422856f5d2d6d1f3e5b5299ff5bd4d4b55e4b5576b1ccf90acf8cd262c37c9d248948181e8cdbcf904ec966b87feeb75d8666a994f7
SSDEEP 24576:fvQbmb3JN+jh2K7LxGI5iRkCEZnT1mBuJkYo8+U+:fTbBK7FGI5iRkCEZnT1mBuJkYo8+U+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4716	4736	rundll32.exe	85
PID 4736 wrote to memory of 4716	4736	rundll32.exe	85
PID 4736 wrote to memory of 4716	4736	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97f00241952bb3f1ede142afbd36c902622faf421ff75f2bfd945d63c143c8b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97f00241952bb3f1ede142afbd36c902622faf421ff75f2bfd945d63c143c8b7.dll,#1
  2⤵
  PID:4716