yunsip | 2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2022 08:56

Target

2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0.dll
Size

239KB
MD5

07055f944d0504adfdd49c314dce0b78
SHA1

75e4a6d05f1a4830857c1502ea5548beab6f7882
SHA256

2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0
SHA512

410e4f5cfab3ccd941eb94b74dbff43ff76ab7f3a12880b7ca50fcb89d564c1cf48631a540ea70bcaf8042072333d93685eb2c3cd032e24b153697ac9c8fcd81
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0G:jDgtfRQUHPw06MoV2nwTBlhm8u

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4832 wrote to memory of 628	4832	rundll32.exe	rundll32.exe
PID 4832 wrote to memory of 628	4832	rundll32.exe	rundll32.exe
PID 4832 wrote to memory of 628	4832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c60bd1356194c5d505fa408265b75bc1f501057b1f74ce445317b981a9280e0.dll,#1
2⤵
PID:628