kinsing | e42c79cf8f95f7a5d88763da536aeb78109f3eeaec073e6499bbbc3b8c80f011

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:14

Target

74f1fa1e47c94b99edd91f063e1616c5.dll
Size

45KB
MD5

74f1fa1e47c94b99edd91f063e1616c5
SHA1

338a3956372ca2f246152135c7b1b62a09dde212
SHA256

e42c79cf8f95f7a5d88763da536aeb78109f3eeaec073e6499bbbc3b8c80f011
SHA512

d15991f6be367a7f8f1280d4a35a625c7e128afbf4da978d12d0ab69802bd972d699cb0f34ead69b0e422ff8b7c62eb334cefbb42a0f8f3710f3458932c3313f
SSDEEP

768:7qguBvm4rWb0OA27Y1RZijhGt/jsISto9+LSQvLOhiegQ:7qgu7203SYDsjh+sIUVf7

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1520 wrote to memory of 3336	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 3336	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 3336	1520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f1fa1e47c94b99edd91f063e1616c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f1fa1e47c94b99edd91f063e1616c5.dll,#1
2⤵
PID:3336