kinsing | 155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 15:58

Target

155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll
Size

5.5MB
MD5

95b3f93daa6353f164446fe6e93c998d
SHA1

ad1c77f48f721cc84e11f222af51a14a9caf4058
SHA256

155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7
SHA512

3f7bee83993763c30f2f1a51f3210f90a77e413de0699fa83e9a7f4f3ab82d925381507c66b023a93e34295f7cf0a6241c48f0fa4f84c550d332e7a927e3c2a6
SSDEEP

98304:A8UnXrt3bc0O68nEtN7uS36KrxSHvZLNrlhFkH3M09ejSUBqicDNyv4qEcbcPXN:A7bVY0H1NNFeJkXN9vUwr+4Tk2N

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1412 wrote to memory of 2720	1412	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 2720	1412	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 2720	1412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll,#1
2⤵
PID:2720

memory/2720-0-0x0000000074270000-0x00000000749FE000-memory.dmp

Filesize
7.6MB

Download