yunsip | 8e651fa5fa3ca1d8a51eafc19f5b0c92c43498088c16bfec97fef1393163a823

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:43

Target

8e651fa5fa3ca1d8a51eafc19f5b0c92c43498088c16bfec97fef1393163a823.dll
Size

200KB
MD5

1dc58463241a9ba0212d4f99f092060d
SHA1

8181fd57537229e8727cd67b35dd62eae06a2ba1
SHA256

8e651fa5fa3ca1d8a51eafc19f5b0c92c43498088c16bfec97fef1393163a823
SHA512

d63c393e71eff14c5b3ab83e189c939692e001e905a47161ae0ca006a0b3f2cef828f4134faf93df9a777227ccc47120b52e8792847f4afea8c81f2b43fc7d00
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0n:jDgtfRQUHPw06MoV2nwTBlhm8f

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e651fa5fa3ca1d8a51eafc19f5b0c92c43498088c16bfec97fef1393163a823.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e651fa5fa3ca1d8a51eafc19f5b0c92c43498088c16bfec97fef1393163a823.dll,#1
  2⤵
  PID:1260

memory/1260-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download