kinsing | 7b600a06ab4b0160aade8e80dd2fce2e58e1b9f3fa8ba0ae721a84f49cc55463

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 16:07

Target
74ef18a5c9100c1c6ec69d7789df72f1.dll
Size 30KB
Sample240125-tk1d1abbgq
SHA256 7b600a06ab4b0160aade8e80dd2fce2e58e1b9f3fa8ba0ae721a84f49cc55463
MD5 74ef18a5c9100c1c6ec69d7789df72f1
SHA1 a02d6c165072351ea9da1f1055c75095da96c703
SHA512 165db3e04bc8922a28f3719d654b4ba86dadc1c47f9a92696a4214ad6e55ca3ee7bf768831fd492a86d08b75a067417540b5ee615095ce1a216a8ad7c86c446b
SSDEEP 768:fOm1tu/vcg2mTkWToGercFpefimn4dTX0NMp1uf:L/Ah2mT9ToGeoLeqweTIl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2020	1152	rundll32.exe	80
PID 1152 wrote to memory of 2020	1152	rundll32.exe	80
PID 1152 wrote to memory of 2020	1152	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74ef18a5c9100c1c6ec69d7789df72f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74ef18a5c9100c1c6ec69d7789df72f1.dll,#1
  2⤵
  PID:2020

memory/2020-0-0x0000000000660000-0x000000000067E000-memory.dmp

Download

memory/2020-1-0x0000000000660000-0x000000000067E000-memory.dmp

Download