yunsip | 535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 08:45

Target
535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll
Size 306KB
Sample221201-kn9bmsfd2z
SHA256 535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6
MD5 bd8ff93293061314386b884627c40780
SHA1 2892b838949f160adf5f20b992a8a52bdf45a221
SHA512 4af1acdb61e6bea91c388fa407e37b7139492ce1207d6248cc9cd04e9f6dcb711a15a7af04dade1da58e70353033365581cef28348c1d5fdb3d87d74c8688431
SSDEEP 3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0u:jDgtfRQUHPw06MoV2nwTBlhm8m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4500	1484	rundll32.exe	80
PID 1484 wrote to memory of 4500	1484	rundll32.exe	80
PID 1484 wrote to memory of 4500	1484	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\535978adf6989aeee37d45611eeed23d09b5772ad2508ae1c99f95836c0b79f6.dll,#1
  2⤵
  PID:4500