yunsip | 373faa1cdaa71c67ef4c455fea46db8040bfaa55d134532e57ed76b976d6cf6a

Analysis

max time kernel
15s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:04

Target

373faa1cdaa71c67ef4c455fea46db8040bfaa55d134532e57ed76b976d6cf6a.dll
Size

312KB
MD5

63054f77e01b2e846732e2bae6cb04e0
SHA1

65dc9bb48b15c7ab3f028e6607152a06de57a2a1
SHA256

373faa1cdaa71c67ef4c455fea46db8040bfaa55d134532e57ed76b976d6cf6a
SHA512

0128ec0ec4b3d401dd96d93e9fdc023cc59f9548c76e38534400e4c797111832cc9a16fdc5191d4d1abe4f969f9da7c8963c61887f989e695adc93c42d59aeb9
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0y:jDgtfRQUHPw06MoV2nwTBlhm8q

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1360	872	rundll32.exe	27
PID 872 wrote to memory of 1360	872	rundll32.exe	27
PID 872 wrote to memory of 1360	872	rundll32.exe	27
PID 872 wrote to memory of 1360	872	rundll32.exe	27
PID 872 wrote to memory of 1360	872	rundll32.exe	27
PID 872 wrote to memory of 1360	872	rundll32.exe	27
PID 872 wrote to memory of 1360	872	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\373faa1cdaa71c67ef4c455fea46db8040bfaa55d134532e57ed76b976d6cf6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\373faa1cdaa71c67ef4c455fea46db8040bfaa55d134532e57ed76b976d6cf6a.dll,#1
  2⤵
  PID:1360

memory/1360-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download