yunsip | 33c2fbbd37618977a004cb8d1094c0b30f9b986edc4cc91b86472daa8a85dcae

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 07:53

Target

1045795c737ffb0359ddc80529422419.dll
Size

233KB
MD5

1045795c737ffb0359ddc80529422419
SHA1

658cae2e0a6576ed9f72b70600018f163823f1e7
SHA256

33c2fbbd37618977a004cb8d1094c0b30f9b986edc4cc91b86472daa8a85dcae
SHA512

5e5f7bb123cff5b35940b8c0e288d833c5248e56d490a8c4dc1bc62581139cd7b3d073409c4229554a1e94d40b1e986bd843e6e288f8daeedbcff2f72de81a8d
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0m:jDgtfRQUHPw06MoV2nwTBlhm8O

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1888	2024	rundll32.exe	16
PID 2024 wrote to memory of 1888	2024	rundll32.exe	16
PID 2024 wrote to memory of 1888	2024	rundll32.exe	16
PID 2024 wrote to memory of 1888	2024	rundll32.exe	16
PID 2024 wrote to memory of 1888	2024	rundll32.exe	16
PID 2024 wrote to memory of 1888	2024	rundll32.exe	16
PID 2024 wrote to memory of 1888	2024	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1045795c737ffb0359ddc80529422419.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1045795c737ffb0359ddc80529422419.dll,#1
  2⤵
  PID:1888