yunsip | d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474

Analysis

max time kernel
177s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:50

Target

d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474.dll
Size

235KB
MD5

1f51d37daa3be8ef1ab8d12f97bf4a10
SHA1

947e894de93611f5ddc57da27291d8089b43212e
SHA256

d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474
SHA512

4bb6d21c5f2adad327b35d2a42dd515d8c63e25606ea02dd6508f4087296a4440179d4bc5be61388e5a2fcafc477b1d1d399c5174392eb453a11fdcda2713426
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0U:jDgtfRQUHPw06MoV2nwTBlhm8M

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 2336	3460	rundll32.exe	79
PID 3460 wrote to memory of 2336	3460	rundll32.exe	79
PID 3460 wrote to memory of 2336	3460	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d0e2d373add7bda50bf01a60a793c051bbdb65d911e43be636bc0756b642f474.dll,#1
  2⤵
  PID:2336