yunsip | 683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 16:21

Target

683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91.dll
Size

491KB
MD5

58cef722a55cc401496dcdcd8a1989bf
SHA1

611c9a910e0ae8c6942b1110a1ba0632b281c844
SHA256

683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91
SHA512

01552687619c8c4e9ae1bbe57c228946cac3c445ca10b4e48a777baddf4bacc48d87ece032b597a08b9ba103a63f61be2fcbfcd1e263591e77f4bdbbf78aefc8
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDK:o6C5AXbMn7UI1FoV2gwTBlrIckPk

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3584	4696	rundll32.exe	81
PID 4696 wrote to memory of 3584	4696	rundll32.exe	81
PID 4696 wrote to memory of 3584	4696	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\683c2f4fb35b2f3dd89ccbf827e9669df84cb56bfed7de5ef6ca3d857da37c91.dll,#1
  2⤵
  PID:3584