yunsip | ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45

Analysis

max time kernel
222s
max time network
285s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:49

Target

ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45.dll
Size

197KB
MD5

9dc2730df2beae261c771a090cf47bf0
SHA1

0fd3e2e3926dbb78b9848a613f289ccc946411f4
SHA256

ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45
SHA512

bfc56f1f0981df87d3e9cbcf1d12d75d7c35995dcc019549c502be57711198ad1d16cfde36bea8306c0307463f6f885e6b674070ca8c22be136bbf8e47e0d14c
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0M:jDgtfRQUHPw06MoV2nwTBlhm8U

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 4668	2768	rundll32.exe	81
PID 2768 wrote to memory of 4668	2768	rundll32.exe	81
PID 2768 wrote to memory of 4668	2768	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea838fc61f95dfd473500150f7e15760e7bf18452a2ceef95a41698821b14f45.dll,#1
  2⤵
  PID:4668