yunsip | 4bf378a5dae7c9928f325da986ea9e76a0c5f4d1726f04d83fadf7c9192cfa32

Analysis

max time kernel
47s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:46

Target

4bf378a5dae7c9928f325da986ea9e76a0c5f4d1726f04d83fadf7c9192cfa32.dll
Size

562KB
MD5

624f0dd89506bb86cb67cc73ef676d70
SHA1

dc4269b377e36e213888de028935cb14a39fac67
SHA256

4bf378a5dae7c9928f325da986ea9e76a0c5f4d1726f04d83fadf7c9192cfa32
SHA512

bf6652731052c8330fe0823c230e5ad1046798a6685bd15a4b6173b50a10a70ba5a5564cfc7d5b9e3f8ece12a658a36a736f4b1c1fc03512521440902cfb48db
SSDEEP

3072:oDKpt9sSR0HUHPwZWLnWVfEAzV2INwTBftZmc+z+f3Q0g:oDgtfRQUHPw06MoV2swTBlxm8o

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28
PID 624 wrote to memory of 1392	624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf378a5dae7c9928f325da986ea9e76a0c5f4d1726f04d83fadf7c9192cfa32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bf378a5dae7c9928f325da986ea9e76a0c5f4d1726f04d83fadf7c9192cfa32.dll,#1
  2⤵
  PID:1392

memory/1392-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download