yunsip | f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa

Analysis

max time kernel
184s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2022 03:20

Target

f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa.dll
Size

318KB
MD5

0458405e64db4d636d7377248463a0f3
SHA1

53b075c551d09da2d3f5369c1989fe50d6cada3c
SHA256

f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa
SHA512

47462948544e2792fbb033c321fb1419363f56f80b22c94d5a7c9cf7870da6dec21f65124ec86737d6b0c79333df3b23f4849139ff4ade94cf25579cb48f27b7
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDA:o6C5AXbMn7UI1FoV2gwTBlrIckPC

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3536 wrote to memory of 1064	3536	rundll32.exe	rundll32.exe
PID 3536 wrote to memory of 1064	3536	rundll32.exe	rundll32.exe
PID 3536 wrote to memory of 1064	3536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f50a4d586acebbef8b37a522fd78d3753d03c07beb43270ceab53869e547e8fa.dll,#1
2⤵
PID:1064