yunsip | 1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d

Analysis

max time kernel
94s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:56

Target

1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d.dll
Size

557KB
MD5

9ef54416cf1692c42bc42a1c9880f0f0
SHA1

89febff60a2df9f774572d028471912d58bb12a4
SHA256

1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d
SHA512

3e1a0276b939df42a93942e0db31481453a55497bffc259a325a94cbba12e35bd0928eb1a30c027d73b4934f80a76fca2d77bfe0512c862a95b084be461e617c
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q0j:oDgtfRQUHPw06MoV2swTBlxm8L

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1484	1996	rundll32.exe	28
PID 1996 wrote to memory of 1484	1996	rundll32.exe	28
PID 1996 wrote to memory of 1484	1996	rundll32.exe	28
PID 1996 wrote to memory of 1484	1996	rundll32.exe	28
PID 1996 wrote to memory of 1484	1996	rundll32.exe	28
PID 1996 wrote to memory of 1484	1996	rundll32.exe	28
PID 1996 wrote to memory of 1484	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d.dll,#1
  2⤵
  PID:1484

memory/1484-55-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download