yunsip | 31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 15:06

Target

31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80.dll
Size

535KB
MD5

0eff8595ca574ff298ec9f8f7c9b3420
SHA1

c42beb90b03e8f3ac93af2b65aeb8e0fe7701b60
SHA256

31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80
SHA512

e49a08982e2d32cfbccb9ace8b830c43dabdb965e127b2204adbfa395c912c75b928859a41d2ab35d3526b1d97de9549198d260d5d24da76202f5e892be7c1db
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0W:jDgtfRQUHPw06MoV2nwTBlhm8u

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1184	4800	rundll32.exe	83
PID 4800 wrote to memory of 1184	4800	rundll32.exe	83
PID 4800 wrote to memory of 1184	4800	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31de80d650bd81c22022df2a98962ab8f8a66aca3300677a4dcb3aafac665f80.dll,#1
  2⤵
  PID:1184