yunsip | 0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 03:20

Target

0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276.dll
Size

1000KB
MD5

362db426b9e41212b14b741c7dc95cc0
SHA1

2409c4e622cf744484b0327f961c8fb23fc9fa51
SHA256

0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276
SHA512

3867da42d6743567d04acb89cea0dc7cef42037361e4d56c3681bb1aef1d46db00178e4ad5a4453cb94e2eb7df9a9adb950f456f7d86178b0878a87648fad056
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDW:o6C5AXbMn7UI1FoV2gwTBlrIckPY

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 1668	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1668	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1668	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1668	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1668	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1668	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1668	2032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276.dll,#1
2⤵
PID:1668

memory/1668-54-0x0000000000000000-mapping.dmp

Download
memory/1668-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download