yunsip | 7e6407f148a5653a9366e3f0a7813faa9808c6cc86bd02f473e9ef2bb423b938

Analysis

max time kernel
152s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 22:01

Target

7e6407f148a5653a9366e3f0a7813faa9808c6cc86bd02f473e9ef2bb423b938.dll
Size

574KB
MD5

ef157c07db5ac72329c91fd6ff9e6050
SHA1

36b014f5ea0f9888bf8fbbf0888fee44de890983
SHA256

7e6407f148a5653a9366e3f0a7813faa9808c6cc86bd02f473e9ef2bb423b938
SHA512

d3b81a0e52a14d707e066ff887fb61a75b0738cb98e0d2853fe6e9655bc9d59526d4601f27346d8900f898802a8d3d60ad102bf70ecbf8336a5a47173b021d86
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0X:jDgtfRQUHPw06MoV2nwTBlhm8v

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 2452	4596	rundll32.exe	83
PID 4596 wrote to memory of 2452	4596	rundll32.exe	83
PID 4596 wrote to memory of 2452	4596	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e6407f148a5653a9366e3f0a7813faa9808c6cc86bd02f473e9ef2bb423b938.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e6407f148a5653a9366e3f0a7813faa9808c6cc86bd02f473e9ef2bb423b938.dll,#1
  2⤵
  PID:2452