kinsing | 1b724bb98236116f697a0d6de73766c629a5de249533574461c535110d6d3d61

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:59

Target
1b724bb98236116f697a0d6de73766c629a5de249533574461c535110d6d3d61.dll
Size 239KB
Sample240125-tfa9baabf4
SHA256 1b724bb98236116f697a0d6de73766c629a5de249533574461c535110d6d3d61
MD5 2592097ec2a5a0d7111d6117683b5d02
SHA1 7b6538768b9928456cd9e844acf6287dfb083962
SHA512 ac3b369b0665645d8412b822e6211fb11302dde2a8623308dceb39de2b287376f55d104ec78746e592f6e0a090b74caaa1def48e17f4fd4fdef6c66f371c5375
SSDEEP 3072:w6o7VyVtscWvrS+Nd5K4Cd6DnWQjnIdq8EF/0BwD:w6o70VAvm+Nd5KGWQMU8EF8a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4256	1496	rundll32.exe	86
PID 1496 wrote to memory of 4256	1496	rundll32.exe	86
PID 1496 wrote to memory of 4256	1496	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b724bb98236116f697a0d6de73766c629a5de249533574461c535110d6d3d61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b724bb98236116f697a0d6de73766c629a5de249533574461c535110d6d3d61.dll,#1
  2⤵
  PID:4256