yunsip | 58f3bc523e50c199f9e5d7146645ece886c88b81accadfddff5fe1fa3937480a

Analysis

max time kernel
244s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 02:48

Target

58f3bc523e50c199f9e5d7146645ece886c88b81accadfddff5fe1fa3937480a.dll
Size

254KB
MD5

3b993247090725f50d90ca7595891112
SHA1

08572d19091e68449259733f5f568ee1581bdedf
SHA256

58f3bc523e50c199f9e5d7146645ece886c88b81accadfddff5fe1fa3937480a
SHA512

72d8dc63dd3b26a0239f11d12db06c9b6f043c88c4b68939f930206d2a5fc13411620c1e8ee4dfe45f241bbce26641071c62fb333280249ce950046b41a49791
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0t:jDgtfRQUHPw06MoV2nwTBlhm8l

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 692	520	rundll32.exe	28
PID 520 wrote to memory of 692	520	rundll32.exe	28
PID 520 wrote to memory of 692	520	rundll32.exe	28
PID 520 wrote to memory of 692	520	rundll32.exe	28
PID 520 wrote to memory of 692	520	rundll32.exe	28
PID 520 wrote to memory of 692	520	rundll32.exe	28
PID 520 wrote to memory of 692	520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58f3bc523e50c199f9e5d7146645ece886c88b81accadfddff5fe1fa3937480a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58f3bc523e50c199f9e5d7146645ece886c88b81accadfddff5fe1fa3937480a.dll,#1
  2⤵
  PID:692

memory/692-55-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download