kinsing | e8f18a59a3c4a7b9d8f00c203d1c3cecb8b2353d79ba6546e78084796e36f56f

Resubmissions

23/02/2024, 14:34

25/01/2024, 16:04

max time kernel
135s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 16:04

Target
$PLUGINSDIR/InstallOptions.dll
Size 14KB
Sample240125-th1a8abbek
SHA256 31944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d
MD5 5f35212d7e90ee622b10be39b09bd270
SHA1 c4bc9593902adf6daaef37e456dc6100d50d0925
SHA512 7514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0
SSDEEP 192:E4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjaK72dwF7dBOne:tn3T5KdHCMRD/R1cOnrja+BO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	2044	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2044	4692	rundll32.exe	87
PID 4692 wrote to memory of 2044	4692	rundll32.exe	87
PID 4692 wrote to memory of 2044	4692	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 636
    3⤵
    - Program crash
    PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2044 -ip 2044
1⤵
PID:4988