yunsip | 1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2022 10:04

Target

1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528.dll
Size

536KB
MD5

09e1f3dc5d00f80612ec4656fb74d320
SHA1

48e348ecbb7bc3c873b7c6d6efde3115089eb754
SHA256

1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528
SHA512

23a979fd42d9b460b78796f2d32581993fe76bd140157c2f9b05911d260dde81958aa05740c4bbbddc6a08d480f8532040ce3ea8f6bbf4f205eda31963ec184f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0b:jDgtfRQUHPw06MoV2nwTBlhm8T

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1092 wrote to memory of 860	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 860	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 860	1092	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ed7cbbd3637d385d9ff31480d5190205756c5a22bbf77f6a5ba573ae21e5528.dll,#1
2⤵
PID:860