yunsip | 23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030

Analysis

max time kernel
167s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 08:46

Target

23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll
Size

281KB
MD5

ab55e07d29275006bf167b702060ff60
SHA1

a4136ac4043f4866fc418c766f191c08040cf3a8
SHA256

23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030
SHA512

ecb35b7248898e7e50847faffe6d508f4a61c173eb11023b3f5cb945f03a269d3bbf206fcefba296f0b570880d7b80a3ab324d2b19aea3fa59cadd499031134f
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0n:jDgtfRQUHPw06MoV2nwTBlhm8/

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4720	4556	rundll32.exe	79
PID 4556 wrote to memory of 4720	4556	rundll32.exe	79
PID 4556 wrote to memory of 4720	4556	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll,#1
  2⤵
  PID:4720