yunsip | 4246d25e0308f685d265ad2e6e3f16924a16edf6fdfb328c9f75227e6b9636bf

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 08:09

Target

4246d25e0308f685d265ad2e6e3f16924a16edf6fdfb328c9f75227e6b9636bf.dll
Size

358KB
MD5

e1d0efbcd450a46d8cbbebbe75499afa
SHA1

612f33092b3c575b92cf959d78155bcab28fb462
SHA256

4246d25e0308f685d265ad2e6e3f16924a16edf6fdfb328c9f75227e6b9636bf
SHA512

c822989a2cdd72caff6ecb9f59d0cf35ea36cc18e663c817b0f4e2d128c08683707549aefc116b094c4b10aab60d964a0adaf82e6d8be1093feae5f90e6e2c80
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0+:jDgtfRQUHPw06MoV2nwTBlhm8G

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4836	2400	rundll32.exe	82
PID 2400 wrote to memory of 4836	2400	rundll32.exe	82
PID 2400 wrote to memory of 4836	2400	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4246d25e0308f685d265ad2e6e3f16924a16edf6fdfb328c9f75227e6b9636bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4246d25e0308f685d265ad2e6e3f16924a16edf6fdfb328c9f75227e6b9636bf.dll,#1
  2⤵
  PID:4836