yunsip | 704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 05:22

Target

704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867.dll
Size

690KB
MD5

345dfa517d3a4cebbf56302f8d52e110
SHA1

a8280a088d17571716dbe69483370403e2d0a236
SHA256

704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867
SHA512

125dfb10e97244b17e4a60d7f11fd7141476c8a33f1c05d72a93492af11ab6fdd9d2b1fb19f71fa4b2a91ff1fa7540cdfd3215da839ebed47628925f6e1cb567
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q05:jDgtfRQUHPw06MoV2nwTBlhm8h

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 832	1772	rundll32.exe	28
PID 1772 wrote to memory of 832	1772	rundll32.exe	28
PID 1772 wrote to memory of 832	1772	rundll32.exe	28
PID 1772 wrote to memory of 832	1772	rundll32.exe	28
PID 1772 wrote to memory of 832	1772	rundll32.exe	28
PID 1772 wrote to memory of 832	1772	rundll32.exe	28
PID 1772 wrote to memory of 832	1772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867.dll,#1
  2⤵
  PID:832

memory/832-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download