yunsip | 9d475b756aac40178e9f4f116c0d23ae6291bc18ec7ad6c7b422297da9c511e2

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-11-2022 10:04

Target

9d475b756aac40178e9f4f116c0d23ae6291bc18ec7ad6c7b422297da9c511e2.dll
Size

654KB
MD5

407dd48b6e33464cc8c742676c018860
SHA1

5de46a1899087ec727e176980a6335b5eec1bc31
SHA256

9d475b756aac40178e9f4f116c0d23ae6291bc18ec7ad6c7b422297da9c511e2
SHA512

aaf6ca6e488487bf6963d7a6c2b0141dc3ae012f716fcd8fc16423fe62d12e0f4f0bea84b855002d2ff1ff45bd5f9ac6af704d6a71841f17869acb9aa096a208
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8U

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1208 wrote to memory of 1712	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 1712	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 1712	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 1712	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 1712	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 1712	1208	rundll32.exe	rundll32.exe
PID 1208 wrote to memory of 1712	1208	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d475b756aac40178e9f4f116c0d23ae6291bc18ec7ad6c7b422297da9c511e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d475b756aac40178e9f4f116c0d23ae6291bc18ec7ad6c7b422297da9c511e2.dll,#1
2⤵
PID:1712

memory/1712-54-0x0000000000000000-mapping.dmp

Download
memory/1712-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download