kinsing | e1d13e792bc84f5c32307806b0102a8aec303f0b81f73d9e04c890dbcdf2079c

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:58

Target

e1d13e792bc84f5c32307806b0102a8aec303f0b81f73d9e04c890dbcdf2079c.dll
Size

106KB
MD5

410f67dc731b2ba4686624309f0e7d2e
SHA1

37d9c5f6f2818f8ec347e1f03032adcd92fa51a1
SHA256

e1d13e792bc84f5c32307806b0102a8aec303f0b81f73d9e04c890dbcdf2079c
SHA512

fa0c2b34f71c4a99480a189e80a829f3a39c664efafca7fb2ffe79104fcb3b8ac68730e4aba3b6cba1238ec0b26222d61bd859f36c384c0f6d1c4bec6b18b8de
SSDEEP

1536:v40UJo16SIF6+Um7DINQ+soST7ttb+5l4:/s7H+Nw7tcm

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3928 wrote to memory of 2560	3928	rundll32.exe	rundll32.exe
PID 3928 wrote to memory of 2560	3928	rundll32.exe	rundll32.exe
PID 3928 wrote to memory of 2560	3928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1d13e792bc84f5c32307806b0102a8aec303f0b81f73d9e04c890dbcdf2079c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1d13e792bc84f5c32307806b0102a8aec303f0b81f73d9e04c890dbcdf2079c.dll,#1
2⤵
PID:2560