yunsip | 8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 02:46

Target

8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9.dll
Size

278KB
MD5

5cf06264cd21d7fd0fa51b6d5f1ab92d
SHA1

8c63ecac22cb69ad560b8188d445603ef3e6e85b
SHA256

8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9
SHA512

46817310439677b1bd98a57143b59eacfe541e01ea0b16b93ec381e4c0a2e47e05344ff291fd255b2062b1d9389d52348f596689e7c1a14410aac918d0fb33d1
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0B:jDgtfRQUHPw06MoV2nwTBlhm8Z

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4112 wrote to memory of 2688	4112	rundll32.exe	rundll32.exe
PID 4112 wrote to memory of 2688	4112	rundll32.exe	rundll32.exe
PID 4112 wrote to memory of 2688	4112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b6b2e0fbab2fdd19e087f7e77e72a7922181918783cab7433938294d7e178f9.dll,#1
2⤵
PID:2688