yunsip | 704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 05:22

Target

704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867.dll
Size

690KB
MD5

345dfa517d3a4cebbf56302f8d52e110
SHA1

a8280a088d17571716dbe69483370403e2d0a236
SHA256

704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867
SHA512

125dfb10e97244b17e4a60d7f11fd7141476c8a33f1c05d72a93492af11ab6fdd9d2b1fb19f71fa4b2a91ff1fa7540cdfd3215da839ebed47628925f6e1cb567
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q05:jDgtfRQUHPw06MoV2nwTBlhm8h

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4496 wrote to memory of 2408	4496	rundll32.exe	rundll32.exe
PID 4496 wrote to memory of 2408	4496	rundll32.exe	rundll32.exe
PID 4496 wrote to memory of 2408	4496	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\704c6da7c008366f892c0f64a9ff438694407f960ceed1518a925241a86a4867.dll,#1
2⤵
PID:2408