yunsip | 6d7f029697f52c372c0ae618fc62172fdff48bd459871aff122e7918f16ca204

Analysis

max time kernel
112s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 00:12

Target

6d7f029697f52c372c0ae618fc62172fdff48bd459871aff122e7918f16ca204.dll
Size

735KB
MD5

81b3d64b1fc95280f9d2fe5fbf807c40
SHA1

4ff39fc64492a34cf646fcfd7049ab0f7a2f197c
SHA256

6d7f029697f52c372c0ae618fc62172fdff48bd459871aff122e7918f16ca204
SHA512

b28eb426791dd4421e9efb34f7c4ba5eb43ce72651caf5401ea9bd7f33804ac4404102371836bdd4c697c9ca62b667b665d3ba7943a65cf0bf2912b06097ca57
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0m:jDgtfRQUHPw06MoV2nwTBlhm8e

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 1028	3136	rundll32.exe	81
PID 3136 wrote to memory of 1028	3136	rundll32.exe	81
PID 3136 wrote to memory of 1028	3136	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d7f029697f52c372c0ae618fc62172fdff48bd459871aff122e7918f16ca204.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d7f029697f52c372c0ae618fc62172fdff48bd459871aff122e7918f16ca204.dll,#1
  2⤵
  PID:1028