yunsip | 535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 08:45

Target

535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll
Size

306KB
MD5

bd8ff93293061314386b884627c40780
SHA1

2892b838949f160adf5f20b992a8a52bdf45a221
SHA256

535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6
SHA512

4af1acdb61e6bea91c388fa407e37b7139492ce1207d6248cc9cd04e9f6dcb711a15a7af04dade1da58e70353033365581cef28348c1d5fdb3d87d74c8688431
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0u:jDgtfRQUHPw06MoV2nwTBlhm8m

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1484 wrote to memory of 4500	1484	rundll32.exe	rundll32.exe
PID 1484 wrote to memory of 4500	1484	rundll32.exe	rundll32.exe
PID 1484 wrote to memory of 4500	1484	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll,#1
2⤵
PID:4500