kinsing | 85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:55

Target

85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a.dll
Size

4.5MB
MD5

195f9c7376acbb1dfeb75f9a368e7ac4
SHA1

61ee4a15dd45fc9cff447ec435761014323c9628
SHA256

85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a
SHA512

fd27268cb2c6966e6ecd9ffa7e0540c633bb5c476e85e4a78340b114b665c4bf559ecc2ef21b66f7bfc3b169360cbd37667f5fe3bd11f71a9a1fdd2b6c1e5140
SSDEEP

49152:cP/9gKmdAB5dEtXhVEpHKHEEdrTbyUOdI5m7ZwQXSAr:BKm2itXhVgHKkEdrTbyXdQm

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3412 wrote to memory of 3636	3412	rundll32.exe	rundll32.exe
PID 3412 wrote to memory of 3636	3412	rundll32.exe	rundll32.exe
PID 3412 wrote to memory of 3636	3412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85c9dad199470bd0bf5061ae437e83d322be5a4ff416b8aadd549d237fe9154a.dll,#1
2⤵
PID:3636