yunsip | 3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 08:46

Target

3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911.dll
Size

420KB
MD5

b9b7489ac8174fe770906be9c6347850
SHA1

29993674da90eb2a5118cb76ada98b43b9ed304c
SHA256

3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911
SHA512

aea854aceb293e8674edc53d2a1dcf914f1c0027d61446934abb0ee3abf8a7e5061275a649ac0e69266e35812cdd5b85658266013feaa3b677aa37ad27098f0b
SSDEEP

3072:IDKpt9sSR0HUHPwZWLnWVfEAzV2IMwTBftZmc+z+f3Q0u:IDgtfRQUHPw06MoV2dwTBlxm8m

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3796	4512	rundll32.exe	78
PID 4512 wrote to memory of 3796	4512	rundll32.exe	78
PID 4512 wrote to memory of 3796	4512	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3227a2cbe990558b96e933eaae08b8ba9315d3fb3ef5320088f11b83df083911.dll,#1
  2⤵
  PID:3796