yunsip | 1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528

Analysis

max time kernel
15s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-11-2022 10:04

Target

1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528.dll
Size

536KB
MD5

09e1f3dc5d00f80612ec4656fb74d320
SHA1

48e348ecbb7bc3c873b7c6d6efde3115089eb754
SHA256

1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528
SHA512

23a979fd42d9b460b78796f2d32581993fe76bd140157c2f9b05911d260dde81958aa05740c4bbbddc6a08d480f8532040ce3ea8f6bbf4f205eda31963ec184f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0b:jDgtfRQUHPw06MoV2nwTBlhm8T

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528.dll,#1
  2⤵
  PID:1996

memory/1996-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download