yunsip | 76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 23:10

Target

76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f.dll
Size

735KB
MD5

8068521d73c4fcd58b1ff00bf1643a80
SHA1

c6704b1c677490bf66bb0832ef3049701aca1d63
SHA256

76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f
SHA512

2d27c0cc94f4db06c4e71736d767593f7efa21a49331da67bda1343a816fcc4628048b7cf0e96ce05067c4f7804bcbb48e49b861f6ef94cc3dcb92ee064db659
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYh:o6RI1Fo/wT3cJYYYYYYYYYYYYh

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1396 wrote to memory of 5116	1396	rundll32.exe	rundll32.exe
PID 1396 wrote to memory of 5116	1396	rundll32.exe	rundll32.exe
PID 1396 wrote to memory of 5116	1396	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76792c18fd4d9f86edd28cd02cb9edae394c7688740a1e67e5c7754bf4ec969f.dll,#1
2⤵
PID:5116