yunsip | d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474

Analysis

max time kernel
54s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:50

Target

d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474.dll
Size

235KB
MD5

1f51d37daa3be8ef1ab8d12f97bf4a10
SHA1

947e894de93611f5ddc57da27291d8089b43212e
SHA256

d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474
SHA512

4bb6d21c5f2adad327b35d2a42dd515d8c63e25606ea02dd6508f4087296a4440179d4bc5be61388e5a2fcafc477b1d1d399c5174392eb453a11fdcda2713426
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0U:jDgtfRQUHPw06MoV2nwTBlhm8M

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1392 wrote to memory of 1236	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1236	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1236	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1236	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1236	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1236	1392	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1236	1392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474.dll,#1
2⤵
PID:1236

memory/1236-54-0x0000000000000000-mapping.dmp

Download
memory/1236-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download