yunsip | 7fa275cdd52e5a2722b27f3df22664026bdfa1524a7444d6f41e79f3a6f1a540

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 04:42

Target

05ce9d161195e0794b326ca79b1c9619.dll
Size

378KB
MD5

05ce9d161195e0794b326ca79b1c9619
SHA1

5f86d215d3e776283d91545cde595552af5193e3
SHA256

7fa275cdd52e5a2722b27f3df22664026bdfa1524a7444d6f41e79f3a6f1a540
SHA512

408f6a72b94897e5153b800733350fc7b1ca4618bae14d04cdd0f4155a9f187dbb69ea2b3a804e652ad695e5baa1fed076e7811b18cc8868ccc8757c8f75364b
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0w:jDgtfRQUHPw06MoV2nwTBlhm84

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 1492	4708	rundll32.exe	16
PID 4708 wrote to memory of 1492	4708	rundll32.exe	16
PID 4708 wrote to memory of 1492	4708	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ce9d161195e0794b326ca79b1c9619.dll,#1
1⤵
PID:1492

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ce9d161195e0794b326ca79b1c9619.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708