yunsip | eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 21:58

Target

eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7.dll
Size

402KB
MD5

36345723f99a622748ec45cdf4da2590
SHA1

37ec1fe39dd2818c0192b90ebf0e3461af9d6400
SHA256

eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7
SHA512

9d0d0b522ebd004d125d4629610639fa48aaedd27b702ae11d3109a5f6429611b293d9f654712380062bda7221f5327a37c3035449d6be11c63b723d2ec8c401
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0R:jDgtfRQUHPw06MoV2nwTBlhm8Z

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4796	4812	rundll32.exe	80
PID 4812 wrote to memory of 4796	4812	rundll32.exe	80
PID 4812 wrote to memory of 4796	4812	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb88917e52ae6922dd11b4c6189287bcb91f7bfde2934ab3f644fb310f00aef7.dll,#1
  2⤵
  PID:4796