yunsip | 991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 22:01

Target

991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f.dll
Size

367KB
MD5

0031d095445067acf80dc794b0d9c75e
SHA1

2d94bff05e9fbe1f49ba33af38f076574dca4c1d
SHA256

991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f
SHA512

8c16fdee064c030c391523a8adb80bf79a3e9e0cb9fb8e92e000401efd13cf832096ab5930af01f3f672fd7f1205239fde126e4e446db989c01ee236262e0f8c
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0w:jDgtfRQUHPw06MoV2nwTBlhm8I

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4372	4324	rundll32.exe	82
PID 4324 wrote to memory of 4372	4324	rundll32.exe	82
PID 4324 wrote to memory of 4372	4324	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\991bba0a2f8de384e5f09eace59773a85fb3281f433229656b7649b445dfc03f.dll,#1
  2⤵
  PID:4372