kinsing | 1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:01

Target

1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0.dll
Size

246KB
MD5

27630c7903bed35111f686aee0830999
SHA1

a7b2ce3738898686aae060bb1e3ca07624e4bda7
SHA256

1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0
SHA512

2c4e939687ca5ff35c7f4e2663315c3b664e1e8814021c39d50923d83aee8485c9f6cba9c9eebc4ee8cabd2ed3d5f88062912c9fc991b9f941ffc9fd3fc6c50b
SSDEEP

6144:MLONPmu0z6toXgAQdX9OgPh8TcoiwcMXZZ8YBGH:MofdIdNxZZC

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1304 wrote to memory of 5092	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 5092	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 5092	1304	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0.dll,#1
2⤵
PID:5092