yunsip | 683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 16:21

Target

683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91.dll
Size

491KB
MD5

58cef722a55cc401496dcdcd8a1989bf
SHA1

611c9a910e0ae8c6942b1110a1ba0632b281c844
SHA256

683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91
SHA512

01552687619c8c4e9ae1bbe57c228946cac3c445ca10b4e48a777baddf4bacc48d87ece032b597a08b9ba103a63f61be2fcbfcd1e263591e77f4bdbbf78aefc8
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDK:o6C5AXbMn7UI1FoV2gwTBlrIckPk

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 1536	1388	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91.dll,#1
2⤵
PID:1536

memory/1536-54-0x0000000000000000-mapping.dmp

Download
memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download