yunsip | 6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df

Analysis

max time kernel
96s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:55

Target

6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df.dll
Size

668KB
MD5

46306239362bd89178567631d6c15620
SHA1

6b60f46636598e70301b4f10555f6e5a8166bd3d
SHA256

6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df
SHA512

3b59966d6a2e9407707aa648b4382b40967a78f64b4bd73a675cf3d5712ca5210a1c7d17514ecc788d312dacfcafdd1e5de8b4ea103c5d6c5c50e78f7a24f8d7
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8E

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1660	1324	rundll32.exe	28
PID 1324 wrote to memory of 1660	1324	rundll32.exe	28
PID 1324 wrote to memory of 1660	1324	rundll32.exe	28
PID 1324 wrote to memory of 1660	1324	rundll32.exe	28
PID 1324 wrote to memory of 1660	1324	rundll32.exe	28
PID 1324 wrote to memory of 1660	1324	rundll32.exe	28
PID 1324 wrote to memory of 1660	1324	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df.dll,#1
  2⤵
  PID:1660

memory/1660-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download