kinsing | 7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:58

Target

7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d.dll
Size

1.0MB
MD5

ee82b75940bc74fc6e0a99d2fe68fb68
SHA1

64ebb40b03103bc0b318f60f41e70d66bcc462ce
SHA256

7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d
SHA512

0cd381e5fe986758b79af4256f18295a301bef5d9f5708219f1017a1a4a19cc10e85c03587207b91a9c603793f5e0a5179ada1ff991be75217b0e8930ea06449
SSDEEP

24576:RCZfxCtxDxCIWrHeVvnEXVM+59FAVFPtZtbTuHno:cZfxCtxDxCIWr+VvoJ59FAVFPtZ0Hno

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1692 wrote to memory of 508	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 508	1692	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 508	1692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ecbbc4c75436f3954b287ea2543f02d2afceb52e530454e92e58327b9e6352d.dll,#1
2⤵
PID:508