yunsip | d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d

Analysis

max time kernel
4s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:50

Target

d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d.dll
Size

239KB
MD5

f5b00dce2020ca5387c94dcc6a8a8487
SHA1

47c9312a7726b21862a103d210fc8aa4d3cc6c81
SHA256

d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d
SHA512

f9f4d27dc67ca5be7437eee95a8f6eb63ae4013f380504aa752a134aa0284a74a1411957c192f607fd1e26aa803cd2437f842620701d374f74a541015dd8d6da
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Q:jDgtfRQUHPw06MoV2nwTBlhm8I

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 732	1788	rundll32.exe	27
PID 1788 wrote to memory of 732	1788	rundll32.exe	27
PID 1788 wrote to memory of 732	1788	rundll32.exe	27
PID 1788 wrote to memory of 732	1788	rundll32.exe	27
PID 1788 wrote to memory of 732	1788	rundll32.exe	27
PID 1788 wrote to memory of 732	1788	rundll32.exe	27
PID 1788 wrote to memory of 732	1788	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d.dll,#1
  2⤵
  PID:732

memory/732-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download