kinsing | f551fb19367ccf32e5f054d30e10274585863ea0460075e0bc048f5c086e1d12

Analysis

max time kernel
132s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:52

Target
f551fb19367ccf32e5f054d30e10274585863ea0460075e0bc048f5c086e1d12.dll
Size 691KB
Sample240125-tbc74sbabq
SHA256 f551fb19367ccf32e5f054d30e10274585863ea0460075e0bc048f5c086e1d12
MD5 c8f5a249eb9af0f83c34eb1a3dc8e477
SHA1 3c51c975ee3db4f64f643ff70f2d72650a8414c8
SHA512 f98422f0f7419bd44af2d75520fa281f87bef62ea8c809e3f11968230e7fd9486849de997ad81f9d740a9cf69fed79c4d9591c977fefdc586589590d9d622b61
SSDEEP 12288:o1C1YgDBIuKofa3MlF8oQtqhGsZNEgp016UbTNwHP:o1C1YgDBIuK13vrsZAbTuH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3824	2676	rundll32.exe	88
PID 2676 wrote to memory of 3824	2676	rundll32.exe	88
PID 2676 wrote to memory of 3824	2676	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f551fb19367ccf32e5f054d30e10274585863ea0460075e0bc048f5c086e1d12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f551fb19367ccf32e5f054d30e10274585863ea0460075e0bc048f5c086e1d12.dll,#1
  2⤵
  PID:3824