yunsip | f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa

Analysis

max time kernel
38s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 03:20

Target

f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa.dll
Size

318KB
MD5

0458405e64db4d636d7377248463a0f3
SHA1

53b075c551d09da2d3f5369c1989fe50d6cada3c
SHA256

f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa
SHA512

47462948544e2792fbb033c321fb1419363f56f80b22c94d5a7c9cf7870da6dec21f65124ec86737d6b0c79333df3b23f4849139ff4ade94cf25579cb48f27b7
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDA:o6C5AXbMn7UI1FoV2gwTBlrIckPC

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa.dll,#1
  2⤵
  PID:912

memory/912-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download