yunsip | 73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534

Analysis

max time kernel
9s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:55

Target

73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534.dll
Size

544KB
MD5

55c38c2e233ab7d3d727c737ec244780
SHA1

341e466a998ab533cf375d0d7988d5dbb877b075
SHA256

73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534
SHA512

f66e02c4f2fb0c1a8ef30391163a57d43511fd25e709f590338729c7df6b714a033d55eb3d6f81aed40417a24a7e867e5034166c1ad4e8d698446727e5c2149a
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q06:oDgtfRQUHPw06MoV2swTBlxm8C

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2044 wrote to memory of 1228	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1228	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1228	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1228	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1228	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1228	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1228	2044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534.dll,#1
2⤵
PID:1228

memory/1228-54-0x0000000000000000-mapping.dmp

Download
memory/1228-55-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download