yunsip | d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 04:31

Target

d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41.dll
Size

550KB
MD5

0d77b669e3d550ee0edfb0f6db502200
SHA1

231cfa2aa2fa2213020e4ee6c417ef45f74833a7
SHA256

d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41
SHA512

f794e8c494c7d0265a12f5827d4ac1e46a7da0d31fdeeee615e25473f027358d7042ef93ca23a2c7845301591e42810beef65205013645b8cf4f8edccb69acf5
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDl:o6C5AXbMn7UI1FoV2gwTBlrIckPr

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2828 wrote to memory of 3368	2828	rundll32.exe	rundll32.exe
PID 2828 wrote to memory of 3368	2828	rundll32.exe	rundll32.exe
PID 2828 wrote to memory of 3368	2828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d81a3242692f6d155c7d5bf450ad91ac1cd2063fd2539bda1619fab740b2ca41.dll,#1
2⤵
PID:3368