yunsip | 2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 15:06

Target

2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232.dll
Size

477KB
MD5

0c669cf06fcd34aba648886971e4dda9
SHA1

ec8e9815e37342ac2ed5407d22d468041970ba50
SHA256

2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232
SHA512

f4423c8ff0320766af6bdd7872117c098faca9e20c74a1dd30d54af991fe32c77ab55466fc92410c9df415a76b8983dfa574a6bd0ab4bc0debb54ede8da88ebc
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0h:jDgtfRQUHPw06MoV2nwTBlhm85

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2040	1184	rundll32.exe	27
PID 1184 wrote to memory of 2040	1184	rundll32.exe	27
PID 1184 wrote to memory of 2040	1184	rundll32.exe	27
PID 1184 wrote to memory of 2040	1184	rundll32.exe	27
PID 1184 wrote to memory of 2040	1184	rundll32.exe	27
PID 1184 wrote to memory of 2040	1184	rundll32.exe	27
PID 1184 wrote to memory of 2040	1184	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232.dll,#1
  2⤵
  PID:2040

memory/2040-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download