kinsing | a20a84ccd2f8e1f7331192932e05fb53231d62fb36191933604ea85dfd5cd533

Analysis

max time kernel
130s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 16:18

Target

74f3be42019d5715fff96db6c2ebca71.dll
Size

19KB
MD5

74f3be42019d5715fff96db6c2ebca71
SHA1

ccbf5ebb2cc0220d349b18cf673ddac7633c365b
SHA256

a20a84ccd2f8e1f7331192932e05fb53231d62fb36191933604ea85dfd5cd533
SHA512

367324ee594dfc2b0cf8e4b3b04f751054b0d9749a52a275500ffd216e0f4a31ba119d84e2a0ad6ced972fa5a49c5a7bdaa0e3cd83166a1a11dbcca4ac3e3581
SSDEEP

384:pa0h9x9DBDsgp203Pwg1qBiCwB7TgooB6yVUCbvAQxub:pDh9x1Vsgpr3og1DlvJU6yVUU9xub

Score

10^/10

kinsing loader

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WMIApiSrv.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\WMIApiSrv.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	228	WerFault.exe	64

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
228	rundll32.exe
228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 228	2328	rundll32.exe	64
PID 2328 wrote to memory of 228	2328	rundll32.exe	64
PID 2328 wrote to memory of 228	2328	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f3be42019d5715fff96db6c2ebca71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f3be42019d5715fff96db6c2ebca71.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 648
    3⤵
    - Program crash
    PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
1⤵
PID:4492

memory/228-0-0x0000000010080000-0x000000001008F000-memory.dmp

Filesize
60KB

Download
memory/228-1-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/228-3-0x0000000010080000-0x000000001008F000-memory.dmp

Filesize
60KB

Download