yunsip | 04a12d497ace69ad856530c90a4757521792face690c7816e6a3e11a893d2e53

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:57

Target

04a12d497ace69ad856530c90a4757521792face690c7816e6a3e11a893d2e53.dll
Size

573KB
MD5

377b978ff7fdb875ffc57443cb807ac0
SHA1

6421e9be8c629a141643cf55319a938ddcb6000a
SHA256

04a12d497ace69ad856530c90a4757521792face690c7816e6a3e11a893d2e53
SHA512

7f03a47656dd79f609fb194caf78200bfab27f5d852a4727db77cd270e389a83db791923926d8c753f8c9b0f1bdfafa844429f76e3deeed0ef571cf39fdd7864
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0H:jDgtfRQUHPw06MoV2nwTBlhm8/

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1340 wrote to memory of 1228	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1228	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1228	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1228	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1228	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1228	1340	rundll32.exe	rundll32.exe
PID 1340 wrote to memory of 1228	1340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04a12d497ace69ad856530c90a4757521792face690c7816e6a3e11a893d2e53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04a12d497ace69ad856530c90a4757521792face690c7816e6a3e11a893d2e53.dll,#1
2⤵
PID:1228

memory/1228-54-0x0000000000000000-mapping.dmp

Download
memory/1228-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download