yunsip | 9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779

Analysis

max time kernel
33s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:01

Target

9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779.dll
Size

226KB
MD5

db5ba16152c5bccb076ec165ee0c4cb0
SHA1

40ced2671557769517369a9dbdd742fa4a31514e
SHA256

9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779
SHA512

d8b0ef7b8e217c0e85b6d51ef72616b1f943631262fdb61cc55655e0c1e67d841502d68db62d9b5cb3cac57ef8d97a27d6a0a771a554c50326564b5623b49e6f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Z:jDgtfRQUHPw06MoV2nwTBlhm8h

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27
PID 1476 wrote to memory of 1956	1476	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779.dll,#1
  2⤵
  PID:1956

memory/1956-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download