kinsing | 738939864677c5a7e3d6f418f1715ceb2281342dc76b4e09439ade70e391a27f

Analysis

max time kernel
90s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:55

Target

738939864677c5a7e3d6f418f1715ceb2281342dc76b4e09439ade70e391a27f.dll
Size

2.6MB
MD5

6f55bfcf1b3ae4fb0decb7fc5cd52d5f
SHA1

3c9f89365e66e7bb5154a03d3400813954e91759
SHA256

738939864677c5a7e3d6f418f1715ceb2281342dc76b4e09439ade70e391a27f
SHA512

9b69917b29983f9caa364481410f331198e6ac1a549f990448732cff703f787765cfc9548af5fa31d4264a620c09d67254c5feab6152243636ed45c90d88f59e
SSDEEP

49152:n3UxxpEk/xHCyOhoZRfg2yx6reVbTDa0T/:nyTEk/xHCyOgze

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 212 wrote to memory of 3124	212	rundll32.exe	rundll32.exe
PID 212 wrote to memory of 3124	212	rundll32.exe	rundll32.exe
PID 212 wrote to memory of 3124	212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\738939864677c5a7e3d6f418f1715ceb2281342dc76b4e09439ade70e391a27f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\738939864677c5a7e3d6f418f1715ceb2281342dc76b4e09439ade70e391a27f.dll,#1
2⤵
PID:3124