yunsip | dd1f709e758d60539cc0c967384c915b64596cf5af86be4cc912397da6870646

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 01:17

Target

dd1f709e758d60539cc0c967384c915b64596cf5af86be4cc912397da6870646.dll
Size

612KB
MD5

978d363476f3224d8509ba9a894185d6
SHA1

6b67bcc9a77e515b06ee3966ffc9f25a2e701e9b
SHA256

dd1f709e758d60539cc0c967384c915b64596cf5af86be4cc912397da6870646
SHA512

a86cc8b3f77d4fff0da6e37c3009090f98603eb4a4e91d15d8e5078e6dd93c75e87a3d35f0242920efeee8a58e92c4a3ccc506659e81b52f6c53afa5c3de276b
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYW:o6RI1Fo/wT3cJYYYYYYYYYYYYW

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2960	1888	rundll32.exe	28
PID 1888 wrote to memory of 2960	1888	rundll32.exe	28
PID 1888 wrote to memory of 2960	1888	rundll32.exe	28
PID 1888 wrote to memory of 2960	1888	rundll32.exe	28
PID 1888 wrote to memory of 2960	1888	rundll32.exe	28
PID 1888 wrote to memory of 2960	1888	rundll32.exe	28
PID 1888 wrote to memory of 2960	1888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd1f709e758d60539cc0c967384c915b64596cf5af86be4cc912397da6870646.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd1f709e758d60539cc0c967384c915b64596cf5af86be4cc912397da6870646.dll,#1
  2⤵
  PID:2960