yunsip | 945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d

Analysis

max time kernel
38s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 05:20

Target

945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d.dll
Size

291KB
MD5

5a12dd01e2c0830ce2f7ce2f23d7d400
SHA1

d6b7291867f42e5a51e4b153cf351de7e2a5c3f5
SHA256

945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d
SHA512

94a68bf1dec3bbe1ef64bca1d1d63ff66c90c7f5d06a5d5fa93a2a3f28dfccd9f79f8790f978c9fa6d6535da859f82bb3e971b0cc72f8111c2577d7154dac455
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0/:jDgtfRQUHPw06MoV2nwTBlhm8n

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 560	1676	rundll32.exe	28
PID 1676 wrote to memory of 560	1676	rundll32.exe	28
PID 1676 wrote to memory of 560	1676	rundll32.exe	28
PID 1676 wrote to memory of 560	1676	rundll32.exe	28
PID 1676 wrote to memory of 560	1676	rundll32.exe	28
PID 1676 wrote to memory of 560	1676	rundll32.exe	28
PID 1676 wrote to memory of 560	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d.dll,#1
  2⤵
  PID:560

memory/560-55-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download