Analysis

  • max time kernel
    5s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01-12-2022 08:42

General

  • Target

    b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll

  • Size

    271KB

  • MD5

    b11328b8bbf06706a96a084f9b23061e

  • SHA1

    69ba62c0abd65a895ea5992bde51fee6b6d15824

  • SHA256

    b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86

  • SHA512

    f9dc0d3e0d6d1dcfb776b4745e885819241121ce9ac7425a7ae89011e94be052b975798f7c0a334558e3c3293d746c6103b9a219ed1fdb4e007097b53d4e70b9

  • SSDEEP

    3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0C:jDgtfRQUHPw06MoV2nwTBlhm8q

Score
10/10

Malware Config

Signatures

  • Yunsip

    Remote backdoor which communicates with a C2 server to receive commands.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll,#1
      2⤵
        PID:948

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/948-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

      Filesize

      8KB