yunsip | 73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534

Analysis

max time kernel
145s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:55

Target

73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534.dll
Size

544KB
MD5

55c38c2e233ab7d3d727c737ec244780
SHA1

341e466a998ab533cf375d0d7988d5dbb877b075
SHA256

73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534
SHA512

f66e02c4f2fb0c1a8ef30391163a57d43511fd25e709f590338729c7df6b714a033d55eb3d6f81aed40417a24a7e867e5034166c1ad4e8d698446727e5c2149a
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q06:oDgtfRQUHPw06MoV2swTBlxm8C

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1476	3508	rundll32.exe	82
PID 3508 wrote to memory of 1476	3508	rundll32.exe	82
PID 3508 wrote to memory of 1476	3508	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73b1e9833aacc01c7563e2c76211f114413959f7e207cc5a461b8e37f5dd2534.dll,#1
  2⤵
  PID:1476