kinsing | d9dc275c083187fb7902475eba9d41bbf8aa2ce8163fe4c21070624385d8f701

Analysis

max time kernel
93s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:58

Target

d9dc275c083187fb7902475eba9d41bbf8aa2ce8163fe4c21070624385d8f701.dll
Size

210KB
MD5

2176cef634e2363b943e618ef9a8036c
SHA1

80bc609f235ac05b6087c449de4bb6891dd0a27a
SHA256

d9dc275c083187fb7902475eba9d41bbf8aa2ce8163fe4c21070624385d8f701
SHA512

cf892b6e46236f12d9eb46b9b546c28c425819c3941cebcdddbf9a714a9c0f71d36593f540fbdcdc033b7c81720b859b57fc61b3a53c1661e143e999967d1925
SSDEEP

3072:qwmMZOCx30kyMwH4Bn0Z5qpt60hZITwOnYbVL4+uPtFEIKSCBuUGV:qwldx30kpwH4vwcGYOxzEaOuUGV

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1548 wrote to memory of 1624	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1624	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1624	1548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9dc275c083187fb7902475eba9d41bbf8aa2ce8163fe4c21070624385d8f701.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9dc275c083187fb7902475eba9d41bbf8aa2ce8163fe4c21070624385d8f701.dll,#1
2⤵
PID:1624