yunsip | 31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 15:06

Target

31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80.dll
Size

535KB
MD5

0eff8595ca574ff298ec9f8f7c9b3420
SHA1

c42beb90b03e8f3ac93af2b65aeb8e0fe7701b60
SHA256

31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80
SHA512

e49a08982e2d32cfbccb9ace8b830c43dabdb965e127b2204adbfa395c912c75b928859a41d2ab35d3526b1d97de9549198d260d5d24da76202f5e892be7c1db
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0W:jDgtfRQUHPw06MoV2nwTBlhm8u

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27
PID 1724 wrote to memory of 1224	1724	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80.dll,#1
  2⤵
  PID:1224

memory/1224-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download