Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2022 12:56

General

  • Target

    261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll

  • Size

    322KB

  • MD5

    79a9e642f531469c20d14d3445fc7040

  • SHA1

    e0b2e7e0b2ebb40826f293c4534e9c778ce29ed1

  • SHA256

    261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2

  • SHA512

    15f8bbfdca32d83ad5b4e4b53afc73d8ee619574b01fd04187e44fc5335ac235e8ba088256f6a39712e7bb4839192e7f746316ae1e4d28db48fec95529d5ed7c

  • SSDEEP

    3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0+:jDgtfRQUHPw06MoV2nwTBlhm82

Score
10/10

Malware Config

Signatures

  • Yunsip

    Remote backdoor which communicates with a C2 server to receive commands.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll,#1
      2⤵
        PID:628

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/628-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

      Filesize

      8KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.