yunsip | 76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 23:10

Target

76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f.dll
Size

735KB
MD5

8068521d73c4fcd58b1ff00bf1643a80
SHA1

c6704b1c677490bf66bb0832ef3049701aca1d63
SHA256

76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f
SHA512

2d27c0cc94f4db06c4e71736d767593f7efa21a49331da67bda1343a816fcc4628048b7cf0e96ce05067c4f7804bcbb48e49b861f6ef94cc3dcb92ee064db659
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYh:o6RI1Fo/wT3cJYYYYYYYYYYYYh

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1936	1744	rundll32.exe	28
PID 1744 wrote to memory of 1936	1744	rundll32.exe	28
PID 1744 wrote to memory of 1936	1744	rundll32.exe	28
PID 1744 wrote to memory of 1936	1744	rundll32.exe	28
PID 1744 wrote to memory of 1936	1744	rundll32.exe	28
PID 1744 wrote to memory of 1936	1744	rundll32.exe	28
PID 1744 wrote to memory of 1936	1744	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f.dll,#1
  2⤵
  PID:1936