kinsing | a20a84ccd2f8e1f7331192932e05fb53231d62fb36191933604ea85dfd5cd533

Analysis

max time kernel
130s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:18

Target

74f3be42019d5715fff96db6c2ebca71.dll
Size

19KB
MD5

74f3be42019d5715fff96db6c2ebca71
SHA1

ccbf5ebb2cc0220d349b18cf673ddac7633c365b
SHA256

a20a84ccd2f8e1f7331192932e05fb53231d62fb36191933604ea85dfd5cd533
SHA512

367324ee594dfc2b0cf8e4b3b04f751054b0d9749a52a275500ffd216e0f4a31ba119d84e2a0ad6ced972fa5a49c5a7bdaa0e3cd83166a1a11dbcca4ac3e3581
SSDEEP

384:pa0h9x9DBDsgp203Pwg1qBiCwB7TgooB6yVUCbvAQxub:pDh9x1Vsgpr3og1DlvJU6yVUU9xub

Score

10^/10

kinsing loader

Drops file in System32 directory 2 IoCs

Processes:

rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WMIApiSrv.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\WMIApiSrv.dll	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2672 228 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

228 rundll32.exe
228 rundll32.exe

pid	pid_target	process	target process
2672	228	WerFault.exe	rundll32.exe

pid	process
228	rundll32.exe
228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2328 wrote to memory of 228	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 228	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 228	2328	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f3be42019d5715fff96db6c2ebca71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 648
3⤵
- Program crash
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
1⤵
PID:4492

memory/228-0-0x0000000010080000-0x000000001008F000-memory.dmp

Filesize
60KB

Download
memory/228-1-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/228-3-0x0000000010080000-0x000000001008F000-memory.dmp

Filesize
60KB

Download