yunsip | 44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934

Analysis

max time kernel
52s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:56

Target

44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934.dll
Size

513KB
MD5

b81d7779bd33d5f6daf3b705ab519120
SHA1

b897293932ab68a0b6d081ceffb35acdbc87d2d4
SHA256

44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934
SHA512

3c100591fce91233603515ef8ed9c04ae0540cebf81e92533dc3fb0203c9c546cda6b7e4692573b7d724b254fbc427c3dfe12aa7945e2dbe82cd0efd959a5e76
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q0y:oDgtfRQUHPw06MoV2swTBlxm8q

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1692	1340	rundll32.exe	27
PID 1340 wrote to memory of 1692	1340	rundll32.exe	27
PID 1340 wrote to memory of 1692	1340	rundll32.exe	27
PID 1340 wrote to memory of 1692	1340	rundll32.exe	27
PID 1340 wrote to memory of 1692	1340	rundll32.exe	27
PID 1340 wrote to memory of 1692	1340	rundll32.exe	27
PID 1340 wrote to memory of 1692	1340	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934.dll,#1
  2⤵
  PID:1692

memory/1692-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download