yunsip | f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 16:16

Target

f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c.dll
Size

743KB
MD5

0b52ff223d2c3c457a5a4b90025d9fe0
SHA1

adbd11f8fb56eee839ad6886de23a86ca9c1e556
SHA256

f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c
SHA512

2f9cedc74143cfea4c1597cfa88598d0e84b916a778e222e39a19ec75496ee7d82ea0eda56d98a9ffa751992a364d68fe5e41da7f6101b70b2569b343ba9881a
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDs:o6C5AXbMn7UI1FoV2gwTBlrIckPC

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26
PID 2044 wrote to memory of 1460	2044	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c.dll,#1
  2⤵
  PID:1460

memory/1460-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download