yunsip | 61e54146b40606e836398d3ece39b764c6bb5be428e5b589fa54134a1a45c890

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 17:44

Target

61e54146b40606e836398d3ece39b764c6bb5be428e5b589fa54134a1a45c890.dll
Size

281KB
MD5

2b32cc51f5495323f3c7c9cb2104f3c0
SHA1

73ad2476ee20bc7eb396f4c63d4719dcb2f7ae41
SHA256

61e54146b40606e836398d3ece39b764c6bb5be428e5b589fa54134a1a45c890
SHA512

b042cf1316d0e10be4561fed13d5f65571b41a433b31a86ba2032c7c2938f3a37155a9751d5456ab0a848515e84ab0815ce575068f72bf4b0845f6a73b982dba
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0L:jDgtfRQUHPw06MoV2nwTBlhm8T

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2820 wrote to memory of 3136	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 3136	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 3136	2820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61e54146b40606e836398d3ece39b764c6bb5be428e5b589fa54134a1a45c890.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61e54146b40606e836398d3ece39b764c6bb5be428e5b589fa54134a1a45c890.dll,#1
2⤵
PID:3136