yunsip | b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 08:42

Target

b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll
Size

271KB
MD5

b11328b8bbf06706a96a084f9b23061e
SHA1

69ba62c0abd65a895ea5992bde51fee6b6d15824
SHA256

b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86
SHA512

f9dc0d3e0d6d1dcfb776b4745e885819241121ce9ac7425a7ae89011e94be052b975798f7c0a334558e3c3293d746c6103b9a219ed1fdb4e007097b53d4e70b9
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0C:jDgtfRQUHPw06MoV2nwTBlhm8q

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1812	1608	rundll32.exe	51
PID 1608 wrote to memory of 1812	1608	rundll32.exe	51
PID 1608 wrote to memory of 1812	1608	rundll32.exe	51

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1a6249b3e85bd7eb13e4005e2df7dd566a9da444514e6739bc7408131f13d86.dll,#1
  2⤵
  PID:1812