yunsip | b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:51

Target

b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf.dll
Size

367KB
MD5

6c59f228c1dda5c7c428dd8c4438a4b0
SHA1

9a4fe04865efbdf185fcaefd0cb0b8193f51f18a
SHA256

b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf
SHA512

00d420af28973f4c4b7a2edd82b40b3dd1a8e91f2637df735944c46bb84587872cbedf2c709ceae9666b735039c313a7449be5f9acd25b0bf22dba1343ad6c44
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q09:jDgtfRQUHPw06MoV2nwTBlhm8l

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1592 wrote to memory of 1964	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1964	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1964	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1964	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1964	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1964	1592	rundll32.exe	rundll32.exe
PID 1592 wrote to memory of 1964	1592	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2990b163771e38faa4d79a7590a0887e088a8ad89f793660983c29ce42cb6cf.dll,#1
2⤵
PID:1964

memory/1964-54-0x0000000000000000-mapping.dmp

Download
memory/1964-55-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download