yunsip | 6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df

Analysis

max time kernel
96s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:55

Target

6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df.dll
Size

668KB
MD5

46306239362bd89178567631d6c15620
SHA1

6b60f46636598e70301b4f10555f6e5a8166bd3d
SHA256

6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df
SHA512

3b59966d6a2e9407707aa648b4382b40967a78f64b4bd73a675cf3d5712ca5210a1c7d17514ecc788d312dacfcafdd1e5de8b4ea103c5d6c5c50e78f7a24f8d7
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8E

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1324 wrote to memory of 1660	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1660	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1660	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1660	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1660	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1660	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1660	1324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dd2438d06b6ad4f22526d631c4600a9ca2546309e22b2afb392195b2b4e27df.dll,#1
2⤵
PID:1660

memory/1660-54-0x0000000000000000-mapping.dmp

Download
memory/1660-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download