yunsip | 8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee

Analysis

max time kernel
7s
max time network
52s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:44

Target

8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee.dll
Size

206KB
MD5

931c936aa2764ef843fbfb7bf25e1230
SHA1

6687d5cc373d0dc99c13a3555e2388a1479146cd
SHA256

8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee
SHA512

2ec931e8ad41af48e82eb2bc3ce4da936f1155d47cc56e287f0e401286ba5734bb3055f5860aea5fa4a316d5f11777892dbaa29848332add810efb6b2d676b70
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0R:jDgtfRQUHPw06MoV2nwTBlhm85

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1740	844	rundll32.exe	28
PID 844 wrote to memory of 1740	844	rundll32.exe	28
PID 844 wrote to memory of 1740	844	rundll32.exe	28
PID 844 wrote to memory of 1740	844	rundll32.exe	28
PID 844 wrote to memory of 1740	844	rundll32.exe	28
PID 844 wrote to memory of 1740	844	rundll32.exe	28
PID 844 wrote to memory of 1740	844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee.dll,#1
  2⤵
  PID:1740

memory/1740-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download