kinsing | 97c601c1490ba6f1fb1d90f0f6305d56a694417438a2b00ee38863409b9404ac

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:49

Target

7522508cab7b9fa7d8c9de6a7168c1bf.dll
Size

564KB
MD5

7522508cab7b9fa7d8c9de6a7168c1bf
SHA1

6760f675d99a1683b463476e1d65b0bdd82d31b0
SHA256

97c601c1490ba6f1fb1d90f0f6305d56a694417438a2b00ee38863409b9404ac
SHA512

bf58eb9ff593320d0f6b346e3cb050a5553097e03064c433d148368c4b6968bc66943fd154b6975a1e3a6778c332869e196151917df641e394318bfbcfbf2af8
SSDEEP

6144:lsdWO07nul6GDkYdWsh+zLy9ZJPLkSycIC7SFgc4955AubmYwpRqeq8cbsxshld8:am9roQWoiSmcIfbmFpl2bVzhA8X3F

Score

10^/10

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3368-0-0x0000000010000000-0x000000001019E000-memory.dmp	vmprotect
behavioral2/memory/3368-1-0x0000000010000000-0x000000001019E000-memory.dmp	vmprotect
behavioral2/memory/3368-2-0x0000000010000000-0x000000001019E000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 44 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4692 wrote to memory of 3368	4692	rundll32.exe	rundll32.exe
PID 4692 wrote to memory of 3368	4692	rundll32.exe	rundll32.exe
PID 4692 wrote to memory of 3368	4692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7522508cab7b9fa7d8c9de6a7168c1bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7522508cab7b9fa7d8c9de6a7168c1bf.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:3368

memory/3368-0-0x0000000010000000-0x000000001019E000-memory.dmp

Filesize
1.6MB

Download
memory/3368-1-0x0000000010000000-0x000000001019E000-memory.dmp

Filesize
1.6MB

Download
memory/3368-2-0x0000000010000000-0x000000001019E000-memory.dmp

Filesize
1.6MB

Download