kinsing | 8cc0714893949d327050fd7901ea42ec8387483cf576fde686dd75a9aede6bc4

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:53

Target

8cc0714893949d327050fd7901ea42ec8387483cf576fde686dd75a9aede6bc4.dll
Size

1.6MB
MD5

47e11dcd444ca2769c343e9ae049db18
SHA1

87ae29078224972278c2121575115d42bf20ad96
SHA256

8cc0714893949d327050fd7901ea42ec8387483cf576fde686dd75a9aede6bc4
SHA512

6042df3c7b705fbb6904f5368ca4b256bfbaa494a9229fe687c4abf88571cf2b991349bf426f23b0f5f0825bbc601ad4c8d786972a7793cc15988bb7427016c9
SSDEEP

49152:dDysWptrHKhy0iQHUGvZRgID6yi3GYefg9CQXNZMHTVh:mudbg9ze

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 768 wrote to memory of 680	768	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 680	768	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 680	768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cc0714893949d327050fd7901ea42ec8387483cf576fde686dd75a9aede6bc4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cc0714893949d327050fd7901ea42ec8387483cf576fde686dd75a9aede6bc4.dll,#1
2⤵
PID:680