yunsip | 4c5cee68a57b0c43302541f6b89d496d667f6d79b321b8865468ed2222b99ebe

Analysis

max time kernel
61s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 22:03

Target

4c5cee68a57b0c43302541f6b89d496d667f6d79b321b8865468ed2222b99ebe.dll
Size

216KB
MD5

a70b70c5030d4c4cc42b5d1638a35680
SHA1

d6a2772f97b45e659bd49d880ba15ab8a183ea37
SHA256

4c5cee68a57b0c43302541f6b89d496d667f6d79b321b8865468ed2222b99ebe
SHA512

9d13ec22888c716b2be3952be25b9fdf872855bb5aab38e9db3b116f5658155cb21943bd8212757897b1cd874982c062d58a8ced968cae85eadec6a0a3c70d10
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0f:jDgtfRQUHPw06MoV2nwTBlhm83

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3736	3668	rundll32.exe	82
PID 3668 wrote to memory of 3736	3668	rundll32.exe	82
PID 3668 wrote to memory of 3736	3668	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c5cee68a57b0c43302541f6b89d496d667f6d79b321b8865468ed2222b99ebe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c5cee68a57b0c43302541f6b89d496d667f6d79b321b8865468ed2222b99ebe.dll,#1
  2⤵
  PID:3736