yunsip | 0f5d35fd17ee8c14b2a031399cacccdaca406a1fd070a6e84c0c6051613812af

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 15:06

Target

0f5d35fd17ee8c14b2a031399cacccdaca406a1fd070a6e84c0c6051613812af.dll
Size

667KB
MD5

129f15dc60f95f953480fa9454f82b90
SHA1

2a00f91cd84fb1fc7a989100f771ecfd1ab769ee
SHA256

0f5d35fd17ee8c14b2a031399cacccdaca406a1fd070a6e84c0c6051613812af
SHA512

a7d85824e75d1bc2ec508fb932c6b5e065927bae7720734cf509adba0a78732d0b423042950bd62c99021f9a437ee54c9cae83a9623f7d24880306c8a459281d
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0r:jDgtfRQUHPw06MoV2nwTBlhm8j

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 396	4996	rundll32.exe	81
PID 4996 wrote to memory of 396	4996	rundll32.exe	81
PID 4996 wrote to memory of 396	4996	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f5d35fd17ee8c14b2a031399cacccdaca406a1fd070a6e84c0c6051613812af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f5d35fd17ee8c14b2a031399cacccdaca406a1fd070a6e84c0c6051613812af.dll,#1
  2⤵
  PID:396