yunsip | 6ac98ad15378ee1e3bca7d6ce4999be6836962a45784fccc2d14cc86d2487f44

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:02

Target

6ac98ad15378ee1e3bca7d6ce4999be6836962a45784fccc2d14cc86d2487f44.dll
Size

383KB
MD5

1b518c05604a3b61b0bd77a3e65781df
SHA1

b9c175edf06724e53abc85acdb91d11e8a92add5
SHA256

6ac98ad15378ee1e3bca7d6ce4999be6836962a45784fccc2d14cc86d2487f44
SHA512

990a29db07677f7df1bdced99f8b325e1f4ee48a3087099678b0931ff00c475d75d9988aa9a934359394b800ca35cb607e9a7a2ebe431463c8759de108f737fc
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0g:jDgtfRQUHPw06MoV2nwTBlhm8o

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26
PID 784 wrote to memory of 2032	784	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ac98ad15378ee1e3bca7d6ce4999be6836962a45784fccc2d14cc86d2487f44.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ac98ad15378ee1e3bca7d6ce4999be6836962a45784fccc2d14cc86d2487f44.dll,#1
  2⤵
  PID:2032

memory/2032-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download