yunsip | 600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1

Analysis

max time kernel
143s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 15:06

Target

600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1.dll
Size

610KB
MD5

0d2d41a2355f3d27ca14b6f8fd6ba130
SHA1

2cf40a7b5505b1666b007bcac6ca1f7d75a10755
SHA256

600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1
SHA512

f9fafc67f4f5e7d779775da8c9eb86f8aa76f40a6c2b3c1cdb53128fa7ff7908cba6c529521664cc8ef00bf643acfcf6b6f7f4fd6534214069b16de5aff6be9f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q04:jDgtfRQUHPw06MoV2nwTBlhm8g

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4664 wrote to memory of 4676	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4676	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4676	4664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\600454d176a9c5159cd189600a0b72a71f1a747a5b9f54d0f1088ede7d3702b1.dll,#1
2⤵
PID:4676