yunsip | 7f757038633a8b83bdcc71c7de08b81fb3541b86937b08ba538fc9cddb12b91d

Analysis

max time kernel
21s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 15:05

Target

7f757038633a8b83bdcc71c7de08b81fb3541b86937b08ba538fc9cddb12b91d.dll
Size

305KB
MD5

0c394d9ed8eaff7394dc590324ba2770
SHA1

753437eb7b58293ecffdb65b010e9148f808e6a7
SHA256

7f757038633a8b83bdcc71c7de08b81fb3541b86937b08ba538fc9cddb12b91d
SHA512

33fb08c69226027eb476a4549490dd99a167e4c1333fe378cd39aa8cbc73ee796158f48b5ad5768c643c544165ddc91c79b4d6f101f102a083317e7a309ddb8a
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0g:jDgtfRQUHPw06MoV2nwTBlhm8o

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 844	1228	rundll32.exe	27
PID 1228 wrote to memory of 844	1228	rundll32.exe	27
PID 1228 wrote to memory of 844	1228	rundll32.exe	27
PID 1228 wrote to memory of 844	1228	rundll32.exe	27
PID 1228 wrote to memory of 844	1228	rundll32.exe	27
PID 1228 wrote to memory of 844	1228	rundll32.exe	27
PID 1228 wrote to memory of 844	1228	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f757038633a8b83bdcc71c7de08b81fb3541b86937b08ba538fc9cddb12b91d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f757038633a8b83bdcc71c7de08b81fb3541b86937b08ba538fc9cddb12b91d.dll,#1
  2⤵
  PID:844

memory/844-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download