yunsip | 9e80089bc5f078fcb7a6929dc43c888553934b93d9e111d7c3268a69dd02a201

Analysis

max time kernel
94s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 00:43

Target

9e80089bc5f078fcb7a6929dc43c888553934b93d9e111d7c3268a69dd02a201.dll
Size

696KB
MD5

1b2d77c9fe38cdfe80ea1c4c1039cc74
SHA1

db3d23a1b55021d05d67d441b7821a642397cf19
SHA256

9e80089bc5f078fcb7a6929dc43c888553934b93d9e111d7c3268a69dd02a201
SHA512

3a78331fe32bb97bbb6e101ac45d18c1127c2c123736cd32fa6f52e09e1274a0fe13dad02d454d540d69af157327670debcad688417f9a534fc8abcf4e828536
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYq:o6RI1Fo/wT3cJYYYYYYYYYYYYq

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3572	4720	rundll32.exe	85
PID 4720 wrote to memory of 3572	4720	rundll32.exe	85
PID 4720 wrote to memory of 3572	4720	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e80089bc5f078fcb7a6929dc43c888553934b93d9e111d7c3268a69dd02a201.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e80089bc5f078fcb7a6929dc43c888553934b93d9e111d7c3268a69dd02a201.dll,#1
  2⤵
  PID:3572