yunsip | d08fb44e99eb5e1eb4776e907e3826407e2aaa64f1fbe0339dd950bebf4c8dad

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 21:59

Target

d08fb44e99eb5e1eb4776e907e3826407e2aaa64f1fbe0339dd950bebf4c8dad.dll
Size

238KB
MD5

967bbd656351992e4af74260fab1904d
SHA1

d7ebf17da65dd3e77ff0579b1eb8d2f8995207f1
SHA256

d08fb44e99eb5e1eb4776e907e3826407e2aaa64f1fbe0339dd950bebf4c8dad
SHA512

bfe85a948e9e78ac41bf7af0c37ea9fbdc7799e823204b6fc66b733e4d07113b8499b49e64328100a0609946a076ad563a7a845c008e556bcad2b934977fd012
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0D:jDgtfRQUHPw06MoV2nwTBlhm87

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26
PID 364 wrote to memory of 1620	364	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d08fb44e99eb5e1eb4776e907e3826407e2aaa64f1fbe0339dd950bebf4c8dad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d08fb44e99eb5e1eb4776e907e3826407e2aaa64f1fbe0339dd950bebf4c8dad.dll,#1
  2⤵
  PID:1620

memory/1620-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download