kinsing | 155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:58

Target
155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll
Size 5.5MB
Sample240125-tezwaaabe6
SHA256 155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7
MD5 95b3f93daa6353f164446fe6e93c998d
SHA1 ad1c77f48f721cc84e11f222af51a14a9caf4058
SHA512 3f7bee83993763c30f2f1a51f3210f90a77e413de0699fa83e9a7f4f3ab82d925381507c66b023a93e34295f7cf0a6241c48f0fa4f84c550d332e7a927e3c2a6
SSDEEP 98304:A8UnXrt3bc0O68nEtN7uS36KrxSHvZLNrlhFkH3M09ejSUBqicDNyv4qEcbcPXN:A7bVY0H1NNFeJkXN9vUwr+4Tk2N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2720	1412	rundll32.exe	85
PID 1412 wrote to memory of 2720	1412	rundll32.exe	85
PID 1412 wrote to memory of 2720	1412	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll,#1
  2⤵
  PID:2720

memory/2720-0-0x0000000074270000-0x00000000749FE000-memory.dmp

Download