yunsip | eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 02:00

Target

eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c.dll
Size

674KB
MD5

0bdcd181a88e8438de52fda0ceca43e0
SHA1

3bf94dd8bdb8041a61dd4045167d35843928bc62
SHA256

eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c
SHA512

bc91bc309118af5ec34263aceb2265dcc4c77a626704012d0e188c931e7c9ea0956b560fbf43075349e4ceb995c8cf7fbf509b238ff8cf3796b57d2b8aa2de0d
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0S:jDgtfRQUHPw06MoV2nwTBlhm8a

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1364	1536	rundll32.exe	28
PID 1536 wrote to memory of 1364	1536	rundll32.exe	28
PID 1536 wrote to memory of 1364	1536	rundll32.exe	28
PID 1536 wrote to memory of 1364	1536	rundll32.exe	28
PID 1536 wrote to memory of 1364	1536	rundll32.exe	28
PID 1536 wrote to memory of 1364	1536	rundll32.exe	28
PID 1536 wrote to memory of 1364	1536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c.dll,#1
  2⤵
  PID:1364

memory/1364-55-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download