yunsip | b2d55712bb23d7cc51c9035a50a88f299a85a405b4e85a429de1970d89187da5

Analysis

max time kernel
25s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 01:25

Target

b2d55712bb23d7cc51c9035a50a88f299a85a405b4e85a429de1970d89187da5.dll
Size

1.1MB
MD5

0b4f0f4a0e0c6f7bd5bbf17d5cb8cbd0
SHA1

5f39e9929e155e05fe7358c8b9367dcc0dd5d668
SHA256

b2d55712bb23d7cc51c9035a50a88f299a85a405b4e85a429de1970d89187da5
SHA512

a7a1c1f211dc2e87b1f43b6939ce096254dc8c0a4e49f879bab95fef8bb4e3ab546e947dae05be23b3cf4d0753a5ae179de58e032708c624eecc1d152e963688
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Z:jDgtfRQUHPw06MoV2nwTBlhm8x

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1824	1988	rundll32.exe	16
PID 1988 wrote to memory of 1824	1988	rundll32.exe	16
PID 1988 wrote to memory of 1824	1988	rundll32.exe	16
PID 1988 wrote to memory of 1824	1988	rundll32.exe	16
PID 1988 wrote to memory of 1824	1988	rundll32.exe	16
PID 1988 wrote to memory of 1824	1988	rundll32.exe	16
PID 1988 wrote to memory of 1824	1988	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2d55712bb23d7cc51c9035a50a88f299a85a405b4e85a429de1970d89187da5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2d55712bb23d7cc51c9035a50a88f299a85a405b4e85a429de1970d89187da5.dll,#1
  2⤵
  PID:1824

memory/1824-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download