yunsip | b0af7d29c3a7665389ec805deb6b035814ef4be83bc4147484f6dbc34cfb0d3a

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 17:39

Target

b0af7d29c3a7665389ec805deb6b035814ef4be83bc4147484f6dbc34cfb0d3a.dll
Size

294KB
MD5

74773b5ea39c25876cb2e36725c3b9c4
SHA1

c70e3c6ab1be1edca9175c118eda59b8dddd990d
SHA256

b0af7d29c3a7665389ec805deb6b035814ef4be83bc4147484f6dbc34cfb0d3a
SHA512

a5b9044f107d31d7eca4ab0da7fd554cae01682cb054ad5e4fa862b96ba8d28febcaec1e5c0aa0052e838b2e50ce375deb006f17f66d6096ead1e923ec44c77b
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0O:jDgtfRQUHPw06MoV2nwTBlhm8m

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4796 wrote to memory of 1720	4796	rundll32.exe	rundll32.exe
PID 4796 wrote to memory of 1720	4796	rundll32.exe	rundll32.exe
PID 4796 wrote to memory of 1720	4796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0af7d29c3a7665389ec805deb6b035814ef4be83bc4147484f6dbc34cfb0d3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0af7d29c3a7665389ec805deb6b035814ef4be83bc4147484f6dbc34cfb0d3a.dll,#1
2⤵
PID:1720