kinsing | 9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:55

Target

9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea.dll
Size

392KB
MD5

217466f90507d443748078554ec1a9eb
SHA1

c69a3bcd43df2d9aea9bd0c91339719b45b62046
SHA256

9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea
SHA512

17e0ff35de839c79a928383cc8afb44bdc6f77431025eef914e39f53dc908009de6151f46d93022cc93fb919fafac9646c3dc1b0a83d96d5d6ef73492a49337e
SSDEEP

6144:F9ybA29CBT9Cul5nGXERHCkpX3afGFBxOGuoaPpZypuUb5p9TwHlM822tz:F9gAMIBikpHaEIGuoaPVUbTNwHPZ

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

844 64 WerFault.exe rundll32.exe

pid	pid_target	process	target process
844	64	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4948 wrote to memory of 64	4948	rundll32.exe	rundll32.exe
PID 4948 wrote to memory of 64	4948	rundll32.exe	rundll32.exe
PID 4948 wrote to memory of 64	4948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a906b554f5036208028b7987cc57d93c6be3ebdfbdd49b7c93f3a23ab8809ea.dll,#1
2⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 624
3⤵
- Program crash
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 64 -ip 64
1⤵
PID:3528