yunsip | ddd53a5c34d130fe228395e42cd2734f2af07abbbce2e75909ab4e155e26ec6f

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 14:56

Target

9326e9aec382263a34568f5da922f7f0_dll32_JC.dll
Size

188KB
MD5

9326e9aec382263a34568f5da922f7f0
SHA1

0811c485fece6187ca74bb02adda7cb004e44b4e
SHA256

ddd53a5c34d130fe228395e42cd2734f2af07abbbce2e75909ab4e155e26ec6f
SHA512

918839578801752b3bb3e59dff3041a4a642263e60e14ec4ff2e0429bb44dd7c334c55dae352baebe7c5e47a67e785675cdb29ff0e8c71bf3f99fe0560cb2cdd
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Z:jDgtfRQUHPw06MoV2nwTBlhm8x

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1708	2956	rundll32.exe	28
PID 2956 wrote to memory of 1708	2956	rundll32.exe	28
PID 2956 wrote to memory of 1708	2956	rundll32.exe	28
PID 2956 wrote to memory of 1708	2956	rundll32.exe	28
PID 2956 wrote to memory of 1708	2956	rundll32.exe	28
PID 2956 wrote to memory of 1708	2956	rundll32.exe	28
PID 2956 wrote to memory of 1708	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9326e9aec382263a34568f5da922f7f0_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9326e9aec382263a34568f5da922f7f0_dll32_JC.dll,#1
  2⤵
  PID:1708