yunsip | f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 16:16

Target

f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c.dll
Size

743KB
MD5

0b52ff223d2c3c457a5a4b90025d9fe0
SHA1

adbd11f8fb56eee839ad6886de23a86ca9c1e556
SHA256

f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c
SHA512

2f9cedc74143cfea4c1597cfa88598d0e84b916a778e222e39a19ec75496ee7d82ea0eda56d98a9ffa751992a364d68fe5e41da7f6101b70b2569b343ba9881a
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDs:o6C5AXbMn7UI1FoV2gwTBlrIckPC

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 4184	1352	rundll32.exe	76
PID 1352 wrote to memory of 4184	1352	rundll32.exe	76
PID 1352 wrote to memory of 4184	1352	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f237bbf03b9fc6d7302fb9d647eb3d4d53eb84caf7c380343186b5ed4106c00c.dll,#1
  2⤵
  PID:4184