yunsip | d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41

Analysis

max time kernel
33s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 04:31

Target

d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41.dll
Size

550KB
MD5

0d77b669e3d550ee0edfb0f6db502200
SHA1

231cfa2aa2fa2213020e4ee6c417ef45f74833a7
SHA256

d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41
SHA512

f794e8c494c7d0265a12f5827d4ac1e46a7da0d31fdeeee615e25473f027358d7042ef93ca23a2c7845301591e42810beef65205013645b8cf4f8edccb69acf5
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDl:o6C5AXbMn7UI1FoV2gwTBlrIckPr

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41.dll,#1
  2⤵
  PID:2032

memory/2032-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download