kinsing | 851fb5cad61b8de7ad6ef923b9372d92a62f1c12de2d17cb53100bdff738624c

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 16:01

Target
851fb5cad61b8de7ad6ef923b9372d92a62f1c12de2d17cb53100bdff738624c.dll
Size 190KB
Sample240125-tgm99sbbbm
SHA256 851fb5cad61b8de7ad6ef923b9372d92a62f1c12de2d17cb53100bdff738624c
MD5 f96f00fa659b589a7fafe600e8336ebf
SHA1 3af189d2a1bf22413f684411f3e9db66bfb9cae5
SHA512 55b9f023f676ef2a691e66f01ab8deceed8780b3bd02cd0b794f085b05985c79e8d30c87084b97db46aa206ef910af92f8766228162c04b8e049ba314d7ae758
SSDEEP 3072:nU/ibmfwOv9aOawOWE8Voluv9RjkFWXeI5EwuEM4r27xo:nU/ijOv9a15WBClubj6rSDuEM4r27
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 4480	1520	rundll32.exe	19
PID 1520 wrote to memory of 4480	1520	rundll32.exe	19
PID 1520 wrote to memory of 4480	1520	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\851fb5cad61b8de7ad6ef923b9372d92a62f1c12de2d17cb53100bdff738624c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\851fb5cad61b8de7ad6ef923b9372d92a62f1c12de2d17cb53100bdff738624c.dll,#1
  2⤵
  PID:4480