yunsip | bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 21:59

Target

bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1.dll
Size

346KB
MD5

5fafc528becaaf8b3413bf79434d3884
SHA1

1c91f5f3ca1eb0d927e6658009abdf718ce6bdbc
SHA256

bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1
SHA512

8b8d4eee6ee30fef0405975bc7fc1f0b44a9b1da3e3edf74971b733f516bd704dbd60bf0886e9ecec0ff925bc853e25ab1eb80b7f3be46362840415bc16149c9
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0z:jDgtfRQUHPw06MoV2nwTBlhm8b

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3536	1056	rundll32.exe	81
PID 1056 wrote to memory of 3536	1056	rundll32.exe	81
PID 1056 wrote to memory of 3536	1056	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf88bc7c73bfc7ecd62b2b0e03233da48569268ffbee5fbd4cbbe0f4cf44e7c1.dll,#1
  2⤵
  PID:3536