yunsip | b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f

Analysis

max time kernel
139s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:51

Target

b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f.dll
Size

232KB
MD5

19e14a95db39dcc4e1f6c64cf0cfc540
SHA1

cd57648c1659fc465b2ed6d9d74afb10ef790f80
SHA256

b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f
SHA512

58bf35b1edf22729f362bfa17b796a7aff706ebf7497d56bcfaedf062cd8685afcdcd49a62ce8fe39a8f7db4acdf5e1cfcb9d9359b784747b264cb18ebd1c6f7
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0x:jDgtfRQUHPw06MoV2nwTBlhm85

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4376 wrote to memory of 1368	4376	rundll32.exe	rundll32.exe
PID 4376 wrote to memory of 1368	4376	rundll32.exe	rundll32.exe
PID 4376 wrote to memory of 1368	4376	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b40e4c9c0aae01a3a73a296cb1737848484e98930bc4d03662990165c6429a9f.dll,#1
2⤵
PID:1368