yunsip | 679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:55

Target

679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93.dll
Size

415KB
MD5

653a8bd55403924a859c426ff4b77d70
SHA1

20af63e067dee257783bab7396641a188107193e
SHA256

679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93
SHA512

1a58174b52120673d85876f5e85aee9411029c21bc2cc05c562726e94a6eb10f14bb9f5720e7f5410c50109e5bd9e821a4487050a28b88af4911faf5ba8ab68f
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q0e:oDgtfRQUHPw06MoV2swTBlxm8W

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679fcb9463812c1a59797720fbf782de23d20f54bdc428c81f944d45dafe7d93.dll,#1
2⤵
PID:1944

memory/1944-54-0x0000000000000000-mapping.dmp

Download
memory/1944-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download