yunsip | 33c2fbbd37618977a004cb8d1094c0b30f9b986edc4cc91b86472daa8a85dcae

Analysis

max time kernel
155s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 20:16

Target

1045795c737ffb0359ddc80529422419.dll
Size

233KB
MD5

1045795c737ffb0359ddc80529422419
SHA1

658cae2e0a6576ed9f72b70600018f163823f1e7
SHA256

33c2fbbd37618977a004cb8d1094c0b30f9b986edc4cc91b86472daa8a85dcae
SHA512

5e5f7bb123cff5b35940b8c0e288d833c5248e56d490a8c4dc1bc62581139cd7b3d073409c4229554a1e94d40b1e986bd843e6e288f8daeedbcff2f72de81a8d
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0m:jDgtfRQUHPw06MoV2nwTBlhm8O

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4488	4032	rundll32.exe	88
PID 4032 wrote to memory of 4488	4032	rundll32.exe	88
PID 4032 wrote to memory of 4488	4032	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1045795c737ffb0359ddc80529422419.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1045795c737ffb0359ddc80529422419.dll,#1
  2⤵
  PID:4488