kinsing | cce784c7d78bed0b40fee05b25279e6a5994f5038a1a2cd49bf79b0d23ce335c

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:00

Target

cce784c7d78bed0b40fee05b25279e6a5994f5038a1a2cd49bf79b0d23ce335c.dll
Size

303KB
MD5

256b69b5b8f58bdc5e876912325043f7
SHA1

4c50f7728ae33839798501bd336d34f01a155ac2
SHA256

cce784c7d78bed0b40fee05b25279e6a5994f5038a1a2cd49bf79b0d23ce335c
SHA512

085eb4a54f28523585b7a632fd2d9223c4d1de89b91df12da27461499838936a15b237b3894718c8458f90c4433e4726093d44ff60cd5acb1de7512ae4a1f89e
SSDEEP

6144:cMZ12bIwkRECyewDDr/ygy1Da1GfQjj5Em:B12bIw8EH7P/yR1D+jj

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3784 wrote to memory of 4684	3784	rundll32.exe	rundll32.exe
PID 3784 wrote to memory of 4684	3784	rundll32.exe	rundll32.exe
PID 3784 wrote to memory of 4684	3784	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cce784c7d78bed0b40fee05b25279e6a5994f5038a1a2cd49bf79b0d23ce335c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cce784c7d78bed0b40fee05b25279e6a5994f5038a1a2cd49bf79b0d23ce335c.dll,#1
2⤵
PID:4684