yunsip | 33a6fcbdbfe8d6f234c4fc4d149af6cb88f0c7972d8c640b8eb6381704024477

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 00:49

Target

bd095d31c3fda1f0913f3fe779225448.dll
Size

281KB
MD5

bd095d31c3fda1f0913f3fe779225448
SHA1

4d0eb36a03199c82df3ec57efc165ac63b4eb05d
SHA256

33a6fcbdbfe8d6f234c4fc4d149af6cb88f0c7972d8c640b8eb6381704024477
SHA512

6158a4230a3abb259274ca06e78290e940c43fe581f4a678dd20bd0e9ddf477b0adf7c38a2b4a89253c0d816b95a307fb797663a91bf56fbb8b295a71f904174
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0L:jDgtfRQUHPw06MoV2nwTBlhm8z

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4692	4080	rundll32.exe	14
PID 4080 wrote to memory of 4692	4080	rundll32.exe	14
PID 4080 wrote to memory of 4692	4080	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd095d31c3fda1f0913f3fe779225448.dll,#1
1⤵
PID:4692

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd095d31c3fda1f0913f3fe779225448.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080