kinsing | dd5029a2dc33c7c3f93d60fb11dc7123719da9bb89c2c0d7191483694f9d37ec

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:42

Target
751f27310d319973ebda39f59fa2d004.exe
Size 20KB
Sample240125-v932vsbhf5
SHA256 dd5029a2dc33c7c3f93d60fb11dc7123719da9bb89c2c0d7191483694f9d37ec
MD5 751f27310d319973ebda39f59fa2d004
SHA1 b427744b2781bc344b96907bf7d68719e65e9dcb
SHA512 60a891dbb202028fa0984e23005b29a013b3dd885385c2ca0d5650ede5794490faee30cd1c47153b10a83fdcb15f900da6dc7e562c9d6272728ffea908c47564
SSDEEP 384:vMCplENKgMwW6nyI4GS1dmrREBmhIbDLUBrxIaa:vM0lEN/uCug2bDLSu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4280	4992	751f27310d319973ebda39f59fa2d004.exe	97
PID 4992 wrote to memory of 4280	4992	751f27310d319973ebda39f59fa2d004.exe	97
PID 4992 wrote to memory of 4280	4992	751f27310d319973ebda39f59fa2d004.exe	97

C:\Users\Admin\AppData\Local\Temp\751f27310d319973ebda39f59fa2d004.exe
"C:\Users\Admin\AppData\Local\Temp\751f27310d319973ebda39f59fa2d004.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:4280

memory/4992-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4992-3-0x0000000000400000-0x000000000040B000-memory.dmp

Download