yunsip | 80721f02713912638f8fd8d30d68c20c33ed0b4da31ddaeda5183f5d2268a0aa

Analysis

max time kernel
122s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 01:25

Target

80721f02713912638f8fd8d30d68c20c33ed0b4da31ddaeda5183f5d2268a0aa.dll
Size

532KB
MD5

0c04409acc4b67b40f17c9a85f3144a0
SHA1

0cae36d68781ad904c3201b59f9bb3d2760c47ce
SHA256

80721f02713912638f8fd8d30d68c20c33ed0b4da31ddaeda5183f5d2268a0aa
SHA512

667408ab700707b20c2821b8d6d360bc969f2c7025396e0421e92f37ce36f3216fdd705767405a5b529805d1fe8d6b2ac06b4c913aefc614c08e37d7198c58e9
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0W:jDgtfRQUHPw06MoV2nwTBlhm8O

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3788	4148	rundll32.exe	15
PID 4148 wrote to memory of 3788	4148	rundll32.exe	15
PID 4148 wrote to memory of 3788	4148	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80721f02713912638f8fd8d30d68c20c33ed0b4da31ddaeda5183f5d2268a0aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80721f02713912638f8fd8d30d68c20c33ed0b4da31ddaeda5183f5d2268a0aa.dll,#1
  2⤵
  PID:3788