kinsing | 19c8c4e882b817e91ec9c7d8edf540342ff2df0f87ad3aaf4394026343470a28

Analysis

max time kernel
92s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:55

Target

19c8c4e882b817e91ec9c7d8edf540342ff2df0f87ad3aaf4394026343470a28.dll
Size

381KB
MD5

8a1f7a72d9ac9bc5947829fbb06cce12
SHA1

df3d871e4122a3624a06f82c344095e20be1ce82
SHA256

19c8c4e882b817e91ec9c7d8edf540342ff2df0f87ad3aaf4394026343470a28
SHA512

3061721d6d7690ecc0373092e163991a095966fdb1960270dda88711b8d20fff2435e18cc7dc498f379983ac7401ca19a87bf270e2ff8cd3a05ddf5f888693b1
SSDEEP

6144:dMwmVYHHDFVag30hmru2zYhTuP0cpuUb5p9TwHlM82/VZ:dB8M4g30hmq2EhTuPgUbTNwHPCV

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4448 672 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4448	672	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1936 wrote to memory of 672	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 672	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 672	1936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19c8c4e882b817e91ec9c7d8edf540342ff2df0f87ad3aaf4394026343470a28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19c8c4e882b817e91ec9c7d8edf540342ff2df0f87ad3aaf4394026343470a28.dll,#1
2⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 612
3⤵
- Program crash
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 672 -ip 672
1⤵
PID:4420