yunsip | 745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 02:47

Target

745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef.dll
Size

374KB
MD5

e4084330522303a4f1281dc798147659
SHA1

18d09845c013bd067feeadd49599812121bafbca
SHA256

745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef
SHA512

49e358496d3f5128e39aa327bca53067b372710230186318d876051554fed189d3f15d983cdc3062f473484abc59040c8b2e0840ba780c3b70d502b3ee67c123
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Q:jDgtfRQUHPw06MoV2nwTBlhm84

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1488 wrote to memory of 1880	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1880	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1880	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1880	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1880	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1880	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1880	1488	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\745945b2c57abab520e17b765e84d1d09fad1124cad8439c568c2c1a332e21ef.dll,#1
2⤵
PID:1880

memory/1880-54-0x0000000000000000-mapping.dmp

Download
memory/1880-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download