yunsip | 82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a

Analysis

max time kernel
1s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 04:31

Target

82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a.dll
Size

490KB
MD5

082cda4326bb408d97c656c413a36910
SHA1

b755a9bc2b8246485e9f20bb65452d27d0d91916
SHA256

82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a
SHA512

fd5ab50aed4ea2de35930a6eef5f48b5d772ab46ffc24b3bb80d6e26e20e53c78625539bd7d7794aa24467b0a6109359ed3db9004cb014f1af18c530335006a5
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDP:o6C5AXbMn7UI1FoV2gwTBlrIckPJ

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1284 wrote to memory of 1420	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1420	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1420	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1420	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1420	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1420	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 1420	1284	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a.dll,#1
2⤵
PID:1420

memory/1420-54-0x0000000000000000-mapping.dmp

Download
memory/1420-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download