yunsip | ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45

Analysis

max time kernel
226s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:49

Target

ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45.dll
Size

197KB
MD5

9dc2730df2beae261c771a090cf47bf0
SHA1

0fd3e2e3926dbb78b9848a613f289ccc946411f4
SHA256

ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45
SHA512

bfc56f1f0981df87d3e9cbcf1d12d75d7c35995dcc019549c502be57711198ad1d16cfde36bea8306c0307463f6f885e6b674070ca8c22be136bbf8e47e0d14c
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0M:jDgtfRQUHPw06MoV2nwTBlhm8U

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1476 wrote to memory of 1652	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1652	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1652	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1652	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1652	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1652	1476	rundll32.exe	rundll32.exe
PID 1476 wrote to memory of 1652	1476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45.dll,#1
2⤵
PID:1652

memory/1652-54-0x0000000000000000-mapping.dmp

Download
memory/1652-55-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download