yunsip | 662093884853a6463fc52cdf34fa4e380d315423b32fa5049f5c70b9f157a99c

Analysis

max time kernel
146s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 03:00

Target

662093884853a6463fc52cdf34fa4e380d315423b32fa5049f5c70b9f157a99c.dll
Size

322KB
MD5

6041c5854b2cfb4918f9de59f490169f
SHA1

4842bbb092753341d9a8b27dcccd1fcd784d154b
SHA256

662093884853a6463fc52cdf34fa4e380d315423b32fa5049f5c70b9f157a99c
SHA512

71fd5d78848d54f22c956f18b92e8f427b508e06570f00576c44aef3d7483dd8e8729bb1413a185a46413fbb9a6f8d4a0efc4f76b8d93400ac1353303b9d7d1b
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0F:jDgtfRQUHPw06MoV2nwTBlhm8t

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3904 wrote to memory of 3288	3904	rundll32.exe	rundll32.exe
PID 3904 wrote to memory of 3288	3904	rundll32.exe	rundll32.exe
PID 3904 wrote to memory of 3288	3904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\662093884853a6463fc52cdf34fa4e380d315423b32fa5049f5c70b9f157a99c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\662093884853a6463fc52cdf34fa4e380d315423b32fa5049f5c70b9f157a99c.dll,#1
2⤵
PID:3288