yunsip | 253cb5a8add6cbf1226c312feab7dd2448b7a29e2adbc73a59d77d90130a325c

Analysis

max time kernel
10s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:05

Target

253cb5a8add6cbf1226c312feab7dd2448b7a29e2adbc73a59d77d90130a325c.dll
Size

289KB
MD5

283ac1b26efe3db0454b98fc7969dba0
SHA1

b24b3b7b674703d13d046cf07b9ff4837da46a22
SHA256

253cb5a8add6cbf1226c312feab7dd2448b7a29e2adbc73a59d77d90130a325c
SHA512

4f875f62fe3b1817a4362df4939f23247a0fca8b7693faaae5bd48161fdaae0ea58dbe09200212051a9f1a536600fb1c108c22482c0397b269c7d7f838dfff06
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0P:jDgtfRQUHPw06MoV2nwTBlhm8n

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28
PID 1460 wrote to memory of 1408	1460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\253cb5a8add6cbf1226c312feab7dd2448b7a29e2adbc73a59d77d90130a325c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\253cb5a8add6cbf1226c312feab7dd2448b7a29e2adbc73a59d77d90130a325c.dll,#1
  2⤵
  PID:1408

memory/1408-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download