kinsing | ee10a3a1f19aad9c48b57b81aaac456ee3d5c2a410eab18bcf781219a5e1de3b

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:26

Target

7516a9359eb3cadfdef22595acbd0eec.dll
Size

213KB
MD5

7516a9359eb3cadfdef22595acbd0eec
SHA1

8d7532cbbab07ccb8cc3e35fe74db70800f065cb
SHA256

ee10a3a1f19aad9c48b57b81aaac456ee3d5c2a410eab18bcf781219a5e1de3b
SHA512

d0847da1102d4d21d52bbe082a6790f7d5ad3a49b08b2c6c1a1e22d4d85ed5d580cd74937778d832f2f9be4ed8b8982cc40455795880d765a6b590c3e59b562d
SSDEEP

3072:tBYkxbLSBYkxbLSBYkxbLSBYkxbLSBYkxbLSBYkxbLSBYkxbL:tBn5+Bn5+Bn5+Bn5+Bn5+Bn5+Bn5

Score

10^/10

kinsing loader

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3668 wrote to memory of 3492	3668	regsvr32.exe	regsvr32.exe
PID 3668 wrote to memory of 3492	3668	regsvr32.exe	regsvr32.exe
PID 3668 wrote to memory of 3492	3668	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7516a9359eb3cadfdef22595acbd0eec.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3668

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\7516a9359eb3cadfdef22595acbd0eec.dll
2⤵
PID:3492