yunsip | 55332fbe7be24412f5c6de026697f0bf935871e1b54991c5b916fbf770ce3cac

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 08:09

Target

55332fbe7be24412f5c6de026697f0bf935871e1b54991c5b916fbf770ce3cac.dll
Size

237KB
MD5

0776b2457ef48bd32b0f598cbd936f23
SHA1

7a6a0c5f46561b0a3e7842463a8534d3a7932cd7
SHA256

55332fbe7be24412f5c6de026697f0bf935871e1b54991c5b916fbf770ce3cac
SHA512

f9b33589230d25fd80dc8f51f64aa7b5cb89a7b726179bc3d88aff0f123282e270fde9fe9c8960d38c7b68a4c64200a1f6e6509e9cd1cbef5e62487fef00d89a
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0l:jDgtfRQUHPw06MoV2nwTBlhm8d

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1256	876	rundll32.exe	81
PID 876 wrote to memory of 1256	876	rundll32.exe	81
PID 876 wrote to memory of 1256	876	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55332fbe7be24412f5c6de026697f0bf935871e1b54991c5b916fbf770ce3cac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55332fbe7be24412f5c6de026697f0bf935871e1b54991c5b916fbf770ce3cac.dll,#1
  2⤵
  PID:1256