yunsip | a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2022 08:56

Target

a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b.dll
Size

225KB
MD5

27115461429b64375169874b3957a9e8
SHA1

01d15f3c2927d757f9c2ee36d83f6896fef9a7ee
SHA256

a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b
SHA512

139472c057ad84e0b1cf2df370e96ea983e1c247a89c370e26439e785eecbe3329c9ffe64c8105148a20d941277ec5da2b81fa3eab35b00f3b46bedb26f51423
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q03:jDgtfRQUHPw06MoV2nwTBlhm8v

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3008 wrote to memory of 2972	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 2972	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 2972	3008	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1c1a9f671c0bed854367179ab5d828fb4b1e33534ee66918254bc2790cb795b.dll,#1
2⤵
PID:2972