yunsip | 83ce31d95de1029766451b3c090f33c9ccff2731bb98d09ecb84ddce95150b1c

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 17:44

Target

83ce31d95de1029766451b3c090f33c9ccff2731bb98d09ecb84ddce95150b1c.dll
Size

506KB
MD5

271a66f1b001e8ba62f4391e96693800
SHA1

135c5447d589215b77f04ec68b8af58c8f7b235c
SHA256

83ce31d95de1029766451b3c090f33c9ccff2731bb98d09ecb84ddce95150b1c
SHA512

31041f170767587d683ad0514d295f3bc4041e9c2db47a87199a22d92fcff5173a788331491dbba6df88eef3390c4e4e2f12aa39bec00be0395b55b8e6224b98
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q09:jDgtfRQUHPw06MoV2nwTBlhm8l

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1112	536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83ce31d95de1029766451b3c090f33c9ccff2731bb98d09ecb84ddce95150b1c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83ce31d95de1029766451b3c090f33c9ccff2731bb98d09ecb84ddce95150b1c.dll,#1
2⤵
PID:1112

memory/1112-54-0x0000000000000000-mapping.dmp

Download
memory/1112-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download