yunsip | d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d

Analysis

max time kernel
189s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:50

Target

d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d.dll
Size

239KB
MD5

f5b00dce2020ca5387c94dcc6a8a8487
SHA1

47c9312a7726b21862a103d210fc8aa4d3cc6c81
SHA256

d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d
SHA512

f9f4d27dc67ca5be7437eee95a8f6eb63ae4013f380504aa752a134aa0284a74a1411957c192f607fd1e26aa803cd2437f842620701d374f74a541015dd8d6da
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Q:jDgtfRQUHPw06MoV2nwTBlhm8I

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 4820	376	rundll32.exe	79
PID 376 wrote to memory of 4820	376	rundll32.exe	79
PID 376 wrote to memory of 4820	376	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d783623414c0e981bdf1398447fef99c4ce0c54acdfe08fa531ec8621c5b762d.dll,#1
  2⤵
  PID:4820