kinsing | 301bc4b4d528b7480f88fae10a069c71fb6ad27c71a445c7c2f520ecb193de52

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:01

Target

301bc4b4d528b7480f88fae10a069c71fb6ad27c71a445c7c2f520ecb193de52.dll
Size

283KB
MD5

758149785e1993a4fa994211a2289263
SHA1

26758b4d6a1103250ca6ab744c8687971f9fc7af
SHA256

301bc4b4d528b7480f88fae10a069c71fb6ad27c71a445c7c2f520ecb193de52
SHA512

5535262d13c233cdcccfe86f58f9ce0d70c2214ca37568fd792ca65b760d25e1ce9c6dee7307a8c4c7e2485c5039808bb1888aa8e18955d36348e58c7a597840
SSDEEP

6144:JhJWhqJpc6bIyJHVJHbQ2UeTB3zj/s/zCTD:DJWCpc6bIyJHVceTZzjEkD

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 372 wrote to memory of 3532	372	rundll32.exe	rundll32.exe
PID 372 wrote to memory of 3532	372	rundll32.exe	rundll32.exe
PID 372 wrote to memory of 3532	372	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\301bc4b4d528b7480f88fae10a069c71fb6ad27c71a445c7c2f520ecb193de52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\301bc4b4d528b7480f88fae10a069c71fb6ad27c71a445c7c2f520ecb193de52.dll,#1
2⤵
PID:3532