yunsip | 0cf1ac8810f732113695501c3caa1d13df30c644d157fddb02693e5097bf7d25

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:05

Target

0cf1ac8810f732113695501c3caa1d13df30c644d157fddb02693e5097bf7d25.dll
Size

281KB
MD5

942166c154e0286716125b5b5550e990
SHA1

9c341682e63a6928f4ced7c81ae68aca501f9372
SHA256

0cf1ac8810f732113695501c3caa1d13df30c644d157fddb02693e5097bf7d25
SHA512

a9f9129f4187419e5863305e727a2ae11f96ba8f299f3326afe0826fa36f7a70b2b18d8f4100d075dfb2a7222ef47bcd3202840a7781ba8180e5271cd7370ba8
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0+:jDgtfRQUHPw06MoV2nwTBlhm8m

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27
PID 1600 wrote to memory of 1396	1600	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cf1ac8810f732113695501c3caa1d13df30c644d157fddb02693e5097bf7d25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cf1ac8810f732113695501c3caa1d13df30c644d157fddb02693e5097bf7d25.dll,#1
  2⤵
  PID:1396

memory/1396-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download