yunsip | 0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 22:05

Target

0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3.dll
Size

392KB
MD5

478df6ec6436b2db864c4a81817b3e20
SHA1

aff7a6bdb7ab0b3ef3fc8506cff404d6f5fbe229
SHA256

0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3
SHA512

684a93f278b7609265b2f044413e267181f219ef98735160a7deb1725fbd67f02adcbf3ee8f5d9dd1979c3f929a1c00d81f146d249bdf8bd3deb3a90a58edd4a
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8U

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4940	4204	rundll32.exe	80
PID 4204 wrote to memory of 4940	4204	rundll32.exe	80
PID 4204 wrote to memory of 4940	4204	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f3381b97a0744b00df9a9858c7a465a195043ec25c99be33d6365f67d64acf3.dll,#1
  2⤵
  PID:4940