yunsip | 1737413725e8d392ec963daaef359b25cf529f971335a5cd4b2fea95ddabc613

Analysis

max time kernel
147s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:23

Target

NEAS.501afcddc0294cc0d853217d4aaf9570.dll
Size

332KB
MD5

501afcddc0294cc0d853217d4aaf9570
SHA1

c4bc4ee943fe83ad7a203553bcdded042f9f0350
SHA256

1737413725e8d392ec963daaef359b25cf529f971335a5cd4b2fea95ddabc613
SHA512

c1db5ba6855c9a22902c69209c4c0dfb141a06e55265b168fab2177b5ac7ecec611cd171080e2859299ec7213f6823a7d441da06d027ed9d4630e7cf6bc09e50
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDO:o6C5AXbMn7UI1FoV2gwTBlrIckPs

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4320	1568	rundll32.exe	86
PID 1568 wrote to memory of 4320	1568	rundll32.exe	86
PID 1568 wrote to memory of 4320	1568	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.501afcddc0294cc0d853217d4aaf9570.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.501afcddc0294cc0d853217d4aaf9570.dll,#1
  2⤵
  PID:4320