yunsip | 9802661483215b6cc6cef53618d6911f6cb7761fa75e85f3b9dbe78c13c95720

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 02:45

Target

9802661483215b6cc6cef53618d6911f6cb7761fa75e85f3b9dbe78c13c95720.dll
Size

351KB
MD5

12971bc35851efcf40d6d286086da577
SHA1

beef5b5ce1b20be434ee1e38425c4c4feeb86892
SHA256

9802661483215b6cc6cef53618d6911f6cb7761fa75e85f3b9dbe78c13c95720
SHA512

5c6e7251b72ca5d8eb4d417cbba7d51672c159b805c7933776b4545ccb363e7dfcb3fab4f4dc812429ffe573f2b9acdd13634365d9d3c58cdab8f408c1dd06ff
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0L:jDgtfRQUHPw06MoV2nwTBlhm8z

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1688	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1688	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1688	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1688	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1688	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1688	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1688	1832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9802661483215b6cc6cef53618d6911f6cb7761fa75e85f3b9dbe78c13c95720.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9802661483215b6cc6cef53618d6911f6cb7761fa75e85f3b9dbe78c13c95720.dll,#1
2⤵
PID:1688

memory/1688-54-0x0000000000000000-mapping.dmp

Download
memory/1688-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download