yunsip | 0ec4bf740231c041c40e710ac24a576ed941fdf1ce0c6bd46ca96891c8bccfa5

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 01:58

Target

0ec4bf740231c041c40e710ac24a576ed941fdf1ce0c6bd46ca96891c8bccfa5.dll
Size

258KB
MD5

49ee4c9a4ae3ecad38b364bd24b355ba
SHA1

de56fe06327fe6dc3752370fe45559929680c155
SHA256

0ec4bf740231c041c40e710ac24a576ed941fdf1ce0c6bd46ca96891c8bccfa5
SHA512

46081ed8bc301d36440999fa35988c5723de76d025d7a1c025fdd92c893a98d2e5a9f5e153ebad068ed4bd1a81131142a03125de956fdc211f4e831fc99ecef8
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0e:jDgtfRQUHPw06MoV2nwTBlhm8G

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec4bf740231c041c40e710ac24a576ed941fdf1ce0c6bd46ca96891c8bccfa5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ec4bf740231c041c40e710ac24a576ed941fdf1ce0c6bd46ca96891c8bccfa5.dll,#1
  2⤵
  PID:1636

memory/1636-54-0x0000000000000000-mapping.dmp

Download
memory/1636-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download