yunsip | d09282b6cca71625f2ad9a4c57b6f481c6c5fa84bdb9cf93b04d7b69dcaf713c

Analysis

max time kernel
112s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:50

Target

d09282b6cca71625f2ad9a4c57b6f481c6c5fa84bdb9cf93b04d7b69dcaf713c.dll
Size

343KB
MD5

6a7a4fb4ee8afd33343026a8667d13d1
SHA1

564f72066654f37706145186b93ff943ed290cf0
SHA256

d09282b6cca71625f2ad9a4c57b6f481c6c5fa84bdb9cf93b04d7b69dcaf713c
SHA512

fa825b3923846689f6ee54bb143038900b1e555dc44769ff31e48c0f7e6c40adddfd48d9ff87c057b94758f6a738bb97157aedefc51cadec95124ea6fe576712
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0/:jDgtfRQUHPw06MoV2nwTBlhm8H

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4836 wrote to memory of 2128	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 2128	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 2128	4836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d09282b6cca71625f2ad9a4c57b6f481c6c5fa84bdb9cf93b04d7b69dcaf713c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d09282b6cca71625f2ad9a4c57b6f481c6c5fa84bdb9cf93b04d7b69dcaf713c.dll,#1
2⤵
PID:2128