yunsip | 8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee

Analysis

max time kernel
256s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 08:44

Target

8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee.dll
Size

206KB
MD5

931c936aa2764ef843fbfb7bf25e1230
SHA1

6687d5cc373d0dc99c13a3555e2388a1479146cd
SHA256

8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee
SHA512

2ec931e8ad41af48e82eb2bc3ce4da936f1155d47cc56e287f0e401286ba5734bb3055f5860aea5fa4a316d5f11777892dbaa29848332add810efb6b2d676b70
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0R:jDgtfRQUHPw06MoV2nwTBlhm85

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2244	1368	rundll32.exe	81
PID 1368 wrote to memory of 2244	1368	rundll32.exe	81
PID 1368 wrote to memory of 2244	1368	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8680a6785ec488a5a133f384c950f3711c9ba8f170dfe0aa63377cd3b8513cee.dll,#1
  2⤵
  PID:2244