kinsing | 509e9420182a36be0bbf43d94aca10f2e4f5e19b891999ee6e873b1fa5354f1d

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 16:21

Target

74f4c2170e8c2f896b700fdc39b8376f.dll
Size

43KB
MD5

74f4c2170e8c2f896b700fdc39b8376f
SHA1

766ba071e05bba99fba184fb8a35db1c1c745b57
SHA256

509e9420182a36be0bbf43d94aca10f2e4f5e19b891999ee6e873b1fa5354f1d
SHA512

0b9f3d7c4c0b8924b867dc6d4423466d2edd4f52d83a56274ec66cb3c0bf4b4e12db9f1a1458141b4356897ba5e886c5a3c98a77706c9ff82971e13c6b675890
SSDEEP

768:aVP8mEUaztn7LgyfT+zvUfP4aX35A+D6fyo5oKcLCDDnW6cN19da:aORPRTkKPf3d6d5ALCDDWHn

Score

10^/10

kinsing loader upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4684-0-0x0000000020000000-0x0000000020023000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2492 wrote to memory of 4684	2492	regsvr32.exe	regsvr32.exe
PID 2492 wrote to memory of 4684	2492	regsvr32.exe	regsvr32.exe
PID 2492 wrote to memory of 4684	2492	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74f4c2170e8c2f896b700fdc39b8376f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\74f4c2170e8c2f896b700fdc39b8376f.dll
2⤵
PID:4684

memory/4684-0-0x0000000020000000-0x0000000020023000-memory.dmp

Filesize
140KB

Download