kinsing | f38a5d2a9e188c95d788cf75aff21e3b97c4158006526db9fe94e3e5e1403ec8

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:51

Target
f38a5d2a9e188c95d788cf75aff21e3b97c4158006526db9fe94e3e5e1403ec8.dll
Size 349KB
Sample240125-taz1gsaag4
SHA256 f38a5d2a9e188c95d788cf75aff21e3b97c4158006526db9fe94e3e5e1403ec8
MD5 f4b3fe24439347428dd1945e00769487
SHA1 480bea45d1eeb9c2080e5471f90596971cae0830
SHA512 fa2d5726f5ac81d48d711b647a408f1717069eefe48e52cdae854408ea4a201febc615fb42f6f5053f38d712e7f63a905e10d5a3df412eb46bd789032032e4af
SSDEEP 3072:HUZii6+5RerwV3X06mgR1IZ7ayocBcDmi7Iwxrm9tLnhkQRw3LCms9PQMguAlntD:MiZ+7TX06mJ7ayoppVkiGFglx1MbG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dumps\dump_20240125155211090.dmp	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3344	rundll32.exe
3344	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 3344	704	rundll32.exe	85
PID 704 wrote to memory of 3344	704	rundll32.exe	85
PID 704 wrote to memory of 3344	704	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f38a5d2a9e188c95d788cf75aff21e3b97c4158006526db9fe94e3e5e1403ec8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f38a5d2a9e188c95d788cf75aff21e3b97c4158006526db9fe94e3e5e1403ec8.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3344