yunsip | a0d2736f3a869b2d3e1c60392df18d2ec8e6ecbab63fe657824c1aa033885ccd

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2024, 23:07

Target

a0d2736f3a869b2d3e1c60392df18d2ec8e6ecbab63fe657824c1aa033885ccd.dll
Size

567KB
MD5

630f965c3340b967ede6e7da7165dbb4
SHA1

fcb8028532a240bb363609c303c38e3d9f0f2e03
SHA256

a0d2736f3a869b2d3e1c60392df18d2ec8e6ecbab63fe657824c1aa033885ccd
SHA512

6460c59d52063bd8c90e818c58b8ebb0f4ebe2e4c03de72f7b2ba9a43142cc2601f7d344429a227b89b5d4725602608102265c1e303118d0cafe7939ca6f5f06
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0I:jDgtfRQUHPw06MoV2nwTBlhm8g

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2336	1076	rundll32.exe	86
PID 1076 wrote to memory of 2336	1076	rundll32.exe	86
PID 1076 wrote to memory of 2336	1076	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0d2736f3a869b2d3e1c60392df18d2ec8e6ecbab63fe657824c1aa033885ccd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0d2736f3a869b2d3e1c60392df18d2ec8e6ecbab63fe657824c1aa033885ccd.dll,#1
  2⤵
  PID:2336