yunsip | 8e467926cb5b94923266bcbc385b4fa5f8904414da9b444bca8e899719bd6628

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:01

Target

8e467926cb5b94923266bcbc385b4fa5f8904414da9b444bca8e899719bd6628.dll
Size

599KB
MD5

2be5d0b301e3da632194c36e82eb8930
SHA1

c8a05a8b5c91eddae76ca508e3c89848efd55e40
SHA256

8e467926cb5b94923266bcbc385b4fa5f8904414da9b444bca8e899719bd6628
SHA512

361927dd33297c9d1f5bd1ccd554f2ec1424a156bc79dc250e4d1b6f2a2ba152cb6d716c09671a7650c6943589eec34384f546323ab2b3d5146fde6a4797c966
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q0W:oDgtfRQUHPw06MoV2swTBlxm8u

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e467926cb5b94923266bcbc385b4fa5f8904414da9b444bca8e899719bd6628.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e467926cb5b94923266bcbc385b4fa5f8904414da9b444bca8e899719bd6628.dll,#1
  2⤵
  PID:1212

memory/1212-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download