kinsing | 7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:58

Target
7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d.dll
Size 1.0MB
Sample240125-tevassabd9
SHA256 7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d
MD5 ee82b75940bc74fc6e0a99d2fe68fb68
SHA1 64ebb40b03103bc0b318f60f41e70d66bcc462ce
SHA512 0cd381e5fe986758b79af4256f18295a301bef5d9f5708219f1017a1a4a19cc10e85c03587207b91a9c603793f5e0a5179ada1ff991be75217b0e8930ea06449
SSDEEP 24576:RCZfxCtxDxCIWrHeVvnEXVM+59FAVFPtZtbTuHno:cZfxCtxDxCIWr+VvoJ59FAVFPtZ0Hno
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 508	1692	rundll32.exe	85
PID 1692 wrote to memory of 508	1692	rundll32.exe	85
PID 1692 wrote to memory of 508	1692	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d.dll,#1
  2⤵
  PID:508