kinsing | fe30e60b0d5b7e04cd33902ea5807ae6d37acfe6edbaa0dd14616da1f83d946b

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:39

Target

751d8279170a44f382bcb36850e1bcaf.dll
Size

13KB
MD5

751d8279170a44f382bcb36850e1bcaf
SHA1

88b5b1b379ad622a8dd8c10f6ffb201b37adeb70
SHA256

fe30e60b0d5b7e04cd33902ea5807ae6d37acfe6edbaa0dd14616da1f83d946b
SHA512

c5e460f04efee85b285763a33f1f4561baf5b8a6691338823cd3ff02520c67b1007988129b5e22647f54c1180d3cceaa483701e8725d4c2cff9dfe49ed7bf600
SSDEEP

192:ndW0u8/Jh0Dl532eJWao4i/tt+mdv1JTcMq176Stq7zit/6CFdl71:rvL0532e83KmdvPTcMNI9Fdlx

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3864	3236	rundll32.exe	86
PID 3236 wrote to memory of 3864	3236	rundll32.exe	86
PID 3236 wrote to memory of 3864	3236	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\751d8279170a44f382bcb36850e1bcaf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\751d8279170a44f382bcb36850e1bcaf.dll,#1
  2⤵
  PID:3864