yunsip | 2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 15:06

Target

2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232.dll
Size

477KB
MD5

0c669cf06fcd34aba648886971e4dda9
SHA1

ec8e9815e37342ac2ed5407d22d468041970ba50
SHA256

2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232
SHA512

f4423c8ff0320766af6bdd7872117c098faca9e20c74a1dd30d54af991fe32c77ab55466fc92410c9df415a76b8983dfa574a6bd0ab4bc0debb54ede8da88ebc
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0h:jDgtfRQUHPw06MoV2nwTBlhm85

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2608	4988	rundll32.exe	81
PID 4988 wrote to memory of 2608	4988	rundll32.exe	81
PID 4988 wrote to memory of 2608	4988	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2909fd0245532d6fccd8226922a8ef92f7eef06fb5b072a90428d4a0b6ccf232.dll,#1
  2⤵
  PID:2608