kinsing | fb4f34faa44821619830b456a3524bafda82c554ef63c5d8fa4ff3c1bcf10a28

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 16:01

Target
fb4f34faa44821619830b456a3524bafda82c554ef63c5d8fa4ff3c1bcf10a28.dll
Size 379KB
Sample240125-tghpsabbbj
SHA256 fb4f34faa44821619830b456a3524bafda82c554ef63c5d8fa4ff3c1bcf10a28
MD5 14f1394a1a035a2b9a6030f1ea760f63
SHA1 c24b0d23a76f5b323a2b9b1da80967cb46cd7b59
SHA512 7a26ac25774054b4818952eeb8abeb15bec6653c851df29c657cefcb6ab65aeb3ad49f92fd2ef8c572a6b9a421d1d6ff6f80a2667634e6b27daf0eacf7a68f43
SSDEEP 6144:6r7K+hLKK5lOIdNe93d4UrZDlYGfXxSe/ZQZgYPjY1ZR:6ph+OY9dbrZDlYSxSnZgYP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3396	1620	rundll32.exe	85
PID 1620 wrote to memory of 3396	1620	rundll32.exe	85
PID 1620 wrote to memory of 3396	1620	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb4f34faa44821619830b456a3524bafda82c554ef63c5d8fa4ff3c1bcf10a28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb4f34faa44821619830b456a3524bafda82c554ef63c5d8fa4ff3c1bcf10a28.dll,#1
  2⤵
  PID:3396