yunsip | 2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 04:31

Target

2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be.dll
Size

527KB
MD5

068fa0fe4f1de47119695cbaa53e6c80
SHA1

ff6cea62bacaa2208669b8f0c388e9949e1d5c86
SHA256

2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be
SHA512

4dfc446d5bb7c405cfcd56c32e4125676ca32973e2ca37afa8b087b7702fbfb6d41d948f48b0a899d62e220e8a5046bd7e8b1856917d158e58a0f5507fe312f9
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDf:o6C5AXbMn7UI1FoV2gwTBlrIckP1

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4568 wrote to memory of 1964	4568	rundll32.exe	rundll32.exe
PID 4568 wrote to memory of 1964	4568	rundll32.exe	rundll32.exe
PID 4568 wrote to memory of 1964	4568	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b1a3a31c14d78f10ba011a0cf31c5bfbf719bcc441ed498fb3f0ea4007b25be.dll,#1
2⤵
PID:1964