yunsip | b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 00:12

Target

b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1.dll
Size

1.0MB
MD5

851ff5589289bb39a007306976088551
SHA1

74c81794d373033edd142c35d1f5d3370417db59
SHA256

b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1
SHA512

27129b7e224ec7ba6a9ac00404dfb8b5869724a0c94dde3f8652224c36395cbb3648ae6d8bfee4672e5d698c50ed393875d01d4509955b9c0c9929be932baa5c
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY6:o6RI1Fo/wT3cJYYYYYYYYYYYY6

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1968 wrote to memory of 1920	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1920	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1920	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1920	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1920	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1920	1968	rundll32.exe	rundll32.exe
PID 1968 wrote to memory of 1920	1968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1.dll,#1
2⤵
PID:1920