yunsip | a9d647f48cc7d3c6cf6aaf975f32ffea9e1425b0c0164255e2c454d25f328bf5

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-11-2022 10:04

Target

a9d647f48cc7d3c6cf6aaf975f32ffea9e1425b0c0164255e2c454d25f328bf5.dll
Size

701KB
MD5

01f25030a3c8ec19e09ffe3b806f63c0
SHA1

31ff9a22f3bdb528ddbbca509068c13d5c2a095a
SHA256

a9d647f48cc7d3c6cf6aaf975f32ffea9e1425b0c0164255e2c454d25f328bf5
SHA512

afd4b61d58d394895807e4fa7436b3ec466d973ffafadfe849a93386466e0c85308b1fefcc058a33c8551af3b5d712feea9b0de75b51768b589b0694035ee96d
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0o2gqTNY4a:jDgtfRQUHPw06MoV2nwTBlhm8pgqTm

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 1324	1644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9d647f48cc7d3c6cf6aaf975f32ffea9e1425b0c0164255e2c454d25f328bf5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9d647f48cc7d3c6cf6aaf975f32ffea9e1425b0c0164255e2c454d25f328bf5.dll,#1
2⤵
PID:1324

memory/1324-54-0x0000000000000000-mapping.dmp

Download
memory/1324-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download