yunsip | 44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934

Analysis

max time kernel
186s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:56

Target

44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934.dll
Size

513KB
MD5

b81d7779bd33d5f6daf3b705ab519120
SHA1

b897293932ab68a0b6d081ceffb35acdbc87d2d4
SHA256

44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934
SHA512

3c100591fce91233603515ef8ed9c04ae0540cebf81e92533dc3fb0203c9c546cda6b7e4692573b7d724b254fbc427c3dfe12aa7945e2dbe82cd0efd959a5e76
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q0y:oDgtfRQUHPw06MoV2swTBlxm8q

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1932 wrote to memory of 3468	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 3468	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 3468	1932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44133c3c35433e4f1a1b5a2007720a6885bd634a0118052815ab0470ef550934.dll,#1
2⤵
PID:3468