yunsip | 3ee28d8d2fead7e9d45a1de5e5837a75476e352640b973c906d855db8f7f2026

Analysis

max time kernel
45s
max time network
97s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 10:26

Target

3ee28d8d2fead7e9d45a1de5e5837a75476e352640b973c906d855db8f7f2026.dll
Size

651KB
MD5

4d1298df40e4f6b9dee95104be943620
SHA1

5a1ee6a851c7b6a987a203528fee6835080a6788
SHA256

3ee28d8d2fead7e9d45a1de5e5837a75476e352640b973c906d855db8f7f2026
SHA512

6ecab982e33a71693d092195b7015ddfc40835b892a86f8724597db517405404ce72304c9a3cde12051f8e9334ca8467561ecbb8c0ae3d96413592687f74144d
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0k:jDgtfRQUHPw06MoV2nwTBlhm8c

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ee28d8d2fead7e9d45a1de5e5837a75476e352640b973c906d855db8f7f2026.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ee28d8d2fead7e9d45a1de5e5837a75476e352640b973c906d855db8f7f2026.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download