yunsip | ac2caa24188fa00f2ebb8d68d4495de063e88142839d230385861ee8f70ee054

Analysis

max time kernel
165s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2023 15:07

Target

bb487c72a4d451c6de3a0a3ac50155c0_dll32_JC.dll
Size

194KB
MD5

bb487c72a4d451c6de3a0a3ac50155c0
SHA1

5a5ff54ca7cd246cbd9d51563e9e50e564a497f5
SHA256

ac2caa24188fa00f2ebb8d68d4495de063e88142839d230385861ee8f70ee054
SHA512

4f6adf9e1eaed2a5933e456961090cdc53ffc6634eaa9ef152d01339473d2bacec89a512eca7737230e0e5f59f01dfbab14b1d92062678b2c8ac3bc7e7c69829
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0x:jDgtfRQUHPw06MoV2nwTBlhm8p

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4852	4928	rundll32.exe	78
PID 4928 wrote to memory of 4852	4928	rundll32.exe	78
PID 4928 wrote to memory of 4852	4928	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb487c72a4d451c6de3a0a3ac50155c0_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb487c72a4d451c6de3a0a3ac50155c0_dll32_JC.dll,#1
  2⤵
  PID:4852