yunsip | 7fa275cdd52e5a2722b27f3df22664026bdfa1524a7444d6f41e79f3a6f1a540

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 04:42

Target

05ce9d161195e0794b326ca79b1c9619.dll
Size

378KB
MD5

05ce9d161195e0794b326ca79b1c9619
SHA1

5f86d215d3e776283d91545cde595552af5193e3
SHA256

7fa275cdd52e5a2722b27f3df22664026bdfa1524a7444d6f41e79f3a6f1a540
SHA512

408f6a72b94897e5153b800733350fc7b1ca4618bae14d04cdd0f4155a9f187dbb69ea2b3a804e652ad695e5baa1fed076e7811b18cc8868ccc8757c8f75364b
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0w:jDgtfRQUHPw06MoV2nwTBlhm84

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28
PID 1064 wrote to memory of 2328	1064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ce9d161195e0794b326ca79b1c9619.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ce9d161195e0794b326ca79b1c9619.dll,#1
  2⤵
  PID:2328