yunsip | 042a484119cb4cd5e6e26c7a18f040189ebed6646d1238672d97c7d73cf79848

Analysis

max time kernel
38s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:05

Target

042a484119cb4cd5e6e26c7a18f040189ebed6646d1238672d97c7d73cf79848.dll
Size

628KB
MD5

eed5d7f8bca65c8925578c40601e5690
SHA1

1164caa8613734cbda22b8a0ae7f5975073abb48
SHA256

042a484119cb4cd5e6e26c7a18f040189ebed6646d1238672d97c7d73cf79848
SHA512

64df01da58204f9d97d7ac606cdc401aa4e14b5f55b63005d5ca47078dfabd1978d096235f4c39cf2e8c928e360a539ca74345bd8d3fd8990c26361ff063d513
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0I:jDgtfRQUHPw06MoV2nwTBlhm8g

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 1108	1332	rundll32.exe	28
PID 1332 wrote to memory of 1108	1332	rundll32.exe	28
PID 1332 wrote to memory of 1108	1332	rundll32.exe	28
PID 1332 wrote to memory of 1108	1332	rundll32.exe	28
PID 1332 wrote to memory of 1108	1332	rundll32.exe	28
PID 1332 wrote to memory of 1108	1332	rundll32.exe	28
PID 1332 wrote to memory of 1108	1332	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\042a484119cb4cd5e6e26c7a18f040189ebed6646d1238672d97c7d73cf79848.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\042a484119cb4cd5e6e26c7a18f040189ebed6646d1238672d97c7d73cf79848.dll,#1
  2⤵
  PID:1108

memory/1108-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download