yunsip | 5bd90431dd51f7c357c11acde901bd94262d1c4cdbff4869bf4977a10868bc76

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 11:00

Target

458442cb31be688b8cbbc26f4eb55be0_JC.dll
Size

787KB
MD5

458442cb31be688b8cbbc26f4eb55be0
SHA1

07b72c6e65f871ca44c65117987f74aaaaa0bb1b
SHA256

5bd90431dd51f7c357c11acde901bd94262d1c4cdbff4869bf4977a10868bc76
SHA512

80b59ba7b46b209a2261da73642692ce309cfb3918dc2a5e3d8aee7d52f1973331a5723835f84c5ed7fd4a91bceabc61774d49115300da85f53e382727ca3ad6
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0KIgXTN:jDgtfRQUHPw06MoV2nwTBlhm8vw

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1996	2428	rundll32.exe	28
PID 2428 wrote to memory of 1996	2428	rundll32.exe	28
PID 2428 wrote to memory of 1996	2428	rundll32.exe	28
PID 2428 wrote to memory of 1996	2428	rundll32.exe	28
PID 2428 wrote to memory of 1996	2428	rundll32.exe	28
PID 2428 wrote to memory of 1996	2428	rundll32.exe	28
PID 2428 wrote to memory of 1996	2428	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\458442cb31be688b8cbbc26f4eb55be0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\458442cb31be688b8cbbc26f4eb55be0_JC.dll,#1
  2⤵
  PID:1996