yunsip | 1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:56

Target

1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d.dll
Size

557KB
MD5

9ef54416cf1692c42bc42a1c9880f0f0
SHA1

89febff60a2df9f774572d028471912d58bb12a4
SHA256

1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d
SHA512

3e1a0276b939df42a93942e0db31481453a55497bffc259a325a94cbba12e35bd0928eb1a30c027d73b4934f80a76fca2d77bfe0512c862a95b084be461e617c
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q0j:oDgtfRQUHPw06MoV2swTBlxm8L

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2864 wrote to memory of 1028	2864	rundll32.exe	rundll32.exe
PID 2864 wrote to memory of 1028	2864	rundll32.exe	rundll32.exe
PID 2864 wrote to memory of 1028	2864	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acf32e6df5a5fd633597a9d799cc135fbb42526985901120a779f742de10d9d.dll,#1
2⤵
PID:1028