yunsip | b95078410f1265f596dc86dcd8e81dbf38d1faeea5f5bd905a300da0adba6f9b

Analysis

max time kernel
168s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 08:42

Target

b95078410f1265f596dc86dcd8e81dbf38d1faeea5f5bd905a300da0adba6f9b.dll
Size

326KB
MD5

a93f6b2a6de0b3a897c24047de499241
SHA1

f1b49d053b648c8582b93385a72e7ef1c7f71379
SHA256

b95078410f1265f596dc86dcd8e81dbf38d1faeea5f5bd905a300da0adba6f9b
SHA512

019cfa5ab5b33debd0f5bd022bf631f18035b1321efd0c5fc1da5b03895cb5739140975841d3e15ac8626dd2107c7a251a1ba76aafb4f92baf07600d1efcfcb6
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0F:jDgtfRQUHPw06MoV2nwTBlhm89

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4008	5020	rundll32.exe	82
PID 5020 wrote to memory of 4008	5020	rundll32.exe	82
PID 5020 wrote to memory of 4008	5020	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b95078410f1265f596dc86dcd8e81dbf38d1faeea5f5bd905a300da0adba6f9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b95078410f1265f596dc86dcd8e81dbf38d1faeea5f5bd905a300da0adba6f9b.dll,#1
  2⤵
  PID:4008