yunsip | b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 02:44

Target

b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c.dll
Size

300KB
MD5

a6df570744da7f07b4ab6b0e8559e271
SHA1

3cd78c9f101a507f12fceb2bc2b44a11e573a6f9
SHA256

b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c
SHA512

7230cdee5d223a261402f1f4f22f0bee89e75e590b7cd06f374ed58c8ec96e1c824d47a722bb97d6c195f517736ed9f4d1bd33dc01fb807932559a63340845e7
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q08:jDgtfRQUHPw06MoV2nwTBlhm8E

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c.dll,#1
  2⤵
  PID:540

memory/540-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download