yunsip | 0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2022 03:20

Target

0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276.dll
Size

1000KB
MD5

362db426b9e41212b14b741c7dc95cc0
SHA1

2409c4e622cf744484b0327f961c8fb23fc9fa51
SHA256

0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276
SHA512

3867da42d6743567d04acb89cea0dc7cef42037361e4d56c3681bb1aef1d46db00178e4ad5a4453cb94e2eb7df9a9adb950f456f7d86178b0878a87648fad056
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDW:o6C5AXbMn7UI1FoV2gwTBlrIckPY

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4968 wrote to memory of 4912	4968	rundll32.exe	rundll32.exe
PID 4968 wrote to memory of 4912	4968	rundll32.exe	rundll32.exe
PID 4968 wrote to memory of 4912	4968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed17d46eb0fe5435cf6f40d156a0d655bacba8b561fd1599062f70e87e18276.dll,#1
2⤵
PID:4912