yunsip | 261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:56

Target

261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll
Size

322KB
MD5

79a9e642f531469c20d14d3445fc7040
SHA1

e0b2e7e0b2ebb40826f293c4534e9c778ce29ed1
SHA256

261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2
SHA512

15f8bbfdca32d83ad5b4e4b53afc73d8ee619574b01fd04187e44fc5335ac235e8ba088256f6a39712e7bb4839192e7f746316ae1e4d28db48fec95529d5ed7c
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0+:jDgtfRQUHPw06MoV2nwTBlhm82

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 960 wrote to memory of 628	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 628	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 628	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 628	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 628	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 628	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 628	960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll,#1
2⤵
PID:628

memory/628-54-0x0000000000000000-mapping.dmp

Download
memory/628-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download