kinsing | 4174000b65b3697b37a7cb0ca3f87b2723caa44c5f2324dff06b744602a17d4b

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:54

Target

4174000b65b3697b37a7cb0ca3f87b2723caa44c5f2324dff06b744602a17d4b.dll
Size

1.6MB
MD5

e361a255bcdc758c8fb29a69b1ee5105
SHA1

90c9642b28338fc545feaf521061782bde9d592d
SHA256

4174000b65b3697b37a7cb0ca3f87b2723caa44c5f2324dff06b744602a17d4b
SHA512

ad32d9e40bff2baf025dfa4c9abdebccfabda0a412afac99b05b75985392e794918a675c291b142a331ee74cda2f1a5f449e98a5c8ae538703533679586b7275
SSDEEP

49152:0Cc2ZZdDSdfTzkrFQbsKcrdr0X0RXWclALDScwZMHHm:DFJ0kRXWD

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5080 wrote to memory of 2300	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 2300	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 2300	5080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4174000b65b3697b37a7cb0ca3f87b2723caa44c5f2324dff06b744602a17d4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4174000b65b3697b37a7cb0ca3f87b2723caa44c5f2324dff06b744602a17d4b.dll,#1
2⤵
PID:2300