yunsip | 23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 08:46

Target

23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll
Size

281KB
MD5

ab55e07d29275006bf167b702060ff60
SHA1

a4136ac4043f4866fc418c766f191c08040cf3a8
SHA256

23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030
SHA512

ecb35b7248898e7e50847faffe6d508f4a61c173eb11023b3f5cb945f03a269d3bbf206fcefba296f0b570880d7b80a3ab324d2b19aea3fa59cadd499031134f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0n:jDgtfRQUHPw06MoV2nwTBlhm8/

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1760 wrote to memory of 1252	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1252	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1252	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1252	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1252	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1252	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1252	1760	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll,#1
2⤵
PID:1252

memory/1252-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1252-54-0x0000000000000000-mapping.dmp

Download