kinsing | 0841f88cc600febce72a8a907b6487b86b75740df6524fc7052c703fec655ce3

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:00

Target

0841f88cc600febce72a8a907b6487b86b75740df6524fc7052c703fec655ce3.dll
Size

932KB
MD5

33c7b2d7c4e20861d8d17721dd164585
SHA1

36b46f673cc7d3460189e4d3fb1f6a717dc03847
SHA256

0841f88cc600febce72a8a907b6487b86b75740df6524fc7052c703fec655ce3
SHA512

6c4d47647cf74b38fb90bbe0e766494ba8cc78fad39ad349ad51e363ceeee356e478e2d5809ecb12bedd1feba0a3434efb22d4f95ef285f0071c7e015ca8fcd3
SSDEEP

12288:T3xtKSTi4ASe26jpBkN2+UWQCTK7D7mQoDffz87h2FyVB/ZgLouxZteTPmNbpL34:jxtKSuVWH2mQoDffzHyVB/ZU7By1B

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4740 wrote to memory of 4756	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 4756	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 4756	4740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0841f88cc600febce72a8a907b6487b86b75740df6524fc7052c703fec655ce3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0841f88cc600febce72a8a907b6487b86b75740df6524fc7052c703fec655ce3.dll,#1
2⤵
PID:4756