kinsing | e22c85f6322f881c99b6fc69a74ce57b1fb7cebf89b6b75722cacf816be23213

Analysis

max time kernel
94s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:51

Target
e22c85f6322f881c99b6fc69a74ce57b1fb7cebf89b6b75722cacf816be23213.dll
Size 1.3MB
Sample240125-tap6aaaaf9
SHA256 e22c85f6322f881c99b6fc69a74ce57b1fb7cebf89b6b75722cacf816be23213
MD5 44307427f1c9dfc50772751d7dc8ad6c
SHA1 4b049ba4c79201cb0f84331a1cd70a0bede263ab
SHA512 b5294a9005e2605e3f08586a2ec92baa513e1763829da6471c4e86b26c11f3319894455054a61b0e6ae55ac2a48365bcfe894a9a2c8431f97ca4410945613db5
SSDEEP 24576:XFNeZp/mmgFnjBMww7YULXSSLkoqK+1PL4fDgauZ2YbTuH:XqZp/mmgFnjBMw+YcfxqK+1PLxVZ2xH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4836	4044	rundll32.exe	84
PID 4044 wrote to memory of 4836	4044	rundll32.exe	84
PID 4044 wrote to memory of 4836	4044	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e22c85f6322f881c99b6fc69a74ce57b1fb7cebf89b6b75722cacf816be23213.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e22c85f6322f881c99b6fc69a74ce57b1fb7cebf89b6b75722cacf816be23213.dll,#1
  2⤵
  PID:4836