yunsip | 171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6

Analysis

max time kernel
154s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 15:06

Target

171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6.dll
Size

742KB
MD5

08f54da040229e0fba57386a0372b300
SHA1

c0ff2234969669aabdde03eaf412a861818e8750
SHA256

171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6
SHA512

7a530b4adbc96258945fcf687bc9a1930b464012892dabf04894638ba35f5aff33029507c23a40be8a04af380854cef3fd98ea762be2d1a40045ae66b9239332
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0K:jDgtfRQUHPw06MoV2nwTBlhm8S

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 884	3732	rundll32.exe	79
PID 3732 wrote to memory of 884	3732	rundll32.exe	79
PID 3732 wrote to memory of 884	3732	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\171f2ae98ea7a4dd9d7801a06cea46a15fe91c937c3bae01d1e6937ed880cee6.dll,#1
  2⤵
  PID:884