kinsing | 85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:55

Target
85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a.dll
Size 4.5MB
Sample240125-tc28maabb8
SHA256 85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a
MD5 195f9c7376acbb1dfeb75f9a368e7ac4
SHA1 61ee4a15dd45fc9cff447ec435761014323c9628
SHA512 fd27268cb2c6966e6ecd9ffa7e0540c633bb5c476e85e4a78340b114b665c4bf559ecc2ef21b66f7bfc3b169360cbd37667f5fe3bd11f71a9a1fdd2b6c1e5140
SSDEEP 49152:cP/9gKmdAB5dEtXhVEpHKHEEdrTbyUOdI5m7ZwQXSAr:BKm2itXhVgHKkEdrTbyXdQm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3636	3412	rundll32.exe	86
PID 3412 wrote to memory of 3636	3412	rundll32.exe	86
PID 3412 wrote to memory of 3636	3412	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a.dll,#1
  2⤵
  PID:3636