kinsing | 1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 16:01

Target
1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0.dll
Size 246KB
Sample240125-tgkt5sbbbl
SHA256 1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0
MD5 27630c7903bed35111f686aee0830999
SHA1 a7b2ce3738898686aae060bb1e3ca07624e4bda7
SHA512 2c4e939687ca5ff35c7f4e2663315c3b664e1e8814021c39d50923d83aee8485c9f6cba9c9eebc4ee8cabd2ed3d5f88062912c9fc991b9f941ffc9fd3fc6c50b
SSDEEP 6144:MLONPmu0z6toXgAQdX9OgPh8TcoiwcMXZZ8YBGH:MofdIdNxZZC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 5092	1304	rundll32.exe	85
PID 1304 wrote to memory of 5092	1304	rundll32.exe	85
PID 1304 wrote to memory of 5092	1304	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8b6133bc58bd97b0d95b9be76109ced192adadb80172059f5d7d55b4e31ad0.dll,#1
  2⤵
  PID:5092