yunsip | 82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 04:31

Target

82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a.dll
Size

490KB
MD5

082cda4326bb408d97c656c413a36910
SHA1

b755a9bc2b8246485e9f20bb65452d27d0d91916
SHA256

82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a
SHA512

fd5ab50aed4ea2de35930a6eef5f48b5d772ab46ffc24b3bb80d6e26e20e53c78625539bd7d7794aa24467b0a6109359ed3db9004cb014f1af18c530335006a5
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDP:o6C5AXbMn7UI1FoV2gwTBlrIckPJ

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2548	2532	rundll32.exe	82
PID 2532 wrote to memory of 2548	2532	rundll32.exe	82
PID 2532 wrote to memory of 2548	2532	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\82c8fac397267d1a97e1fd971a53466a6b4fdd5b0bd692b31a6d648170594a3a.dll,#1
  2⤵
  PID:2548