yunsip | 945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d

Analysis

max time kernel
186s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 05:20

Target

945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d.dll
Size

291KB
MD5

5a12dd01e2c0830ce2f7ce2f23d7d400
SHA1

d6b7291867f42e5a51e4b153cf351de7e2a5c3f5
SHA256

945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d
SHA512

94a68bf1dec3bbe1ef64bca1d1d63ff66c90c7f5d06a5d5fa93a2a3f28dfccd9f79f8790f978c9fa6d6535da859f82bb3e971b0cc72f8111c2577d7154dac455
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0/:jDgtfRQUHPw06MoV2nwTBlhm8n

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 5108	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 5108	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 5108	2040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\945155bb02f89f24ee5a16964aea0f07b89302b3640fd3d7c3f3248aefdbcc2d.dll,#1
2⤵
PID:5108