yunsip | 9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779

Analysis

max time kernel
145s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 22:01

Target

9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779.dll
Size

226KB
MD5

db5ba16152c5bccb076ec165ee0c4cb0
SHA1

40ced2671557769517369a9dbdd742fa4a31514e
SHA256

9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779
SHA512

d8b0ef7b8e217c0e85b6d51ef72616b1f943631262fdb61cc55655e0c1e67d841502d68db62d9b5cb3cac57ef8d97a27d6a0a771a554c50326564b5623b49e6f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Z:jDgtfRQUHPw06MoV2nwTBlhm8h

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3964	2256	rundll32.exe	84
PID 2256 wrote to memory of 3964	2256	rundll32.exe	84
PID 2256 wrote to memory of 3964	2256	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9301a0309f46893916627e7d6c4f2c710cc85408d38ea08a45251dbf28e42779.dll,#1
  2⤵
  PID:3964