yunsip | c53865751fbc11aaf72c7b1e5b0dbb970889e370a31b8f6504b71c57eff09dca

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 02:18

Target

c53865751fbc11aaf72c7b1e5b0dbb970889e370a31b8f6504b71c57eff09dca.dll
Size

449KB
MD5

029f546d3612446fd5875fb5fd61abf7
SHA1

c5400826231ad94b41e0fcb37412890ad1725710
SHA256

c53865751fbc11aaf72c7b1e5b0dbb970889e370a31b8f6504b71c57eff09dca
SHA512

d9c0f9194a3449f54047055ea0f7d7a9f8063498266fdc0898a34c45230ea2045902e615e8fd92fbf190f4030b75cd93ad106861b0eeee71e33db476cb4dd663
SSDEEP

3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDJ:o6C5AXbMn7UI1FoV2gwTBlrIckPj

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 3716	1840	rundll32.exe	86
PID 1840 wrote to memory of 3716	1840	rundll32.exe	86
PID 1840 wrote to memory of 3716	1840	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53865751fbc11aaf72c7b1e5b0dbb970889e370a31b8f6504b71c57eff09dca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53865751fbc11aaf72c7b1e5b0dbb970889e370a31b8f6504b71c57eff09dca.dll,#1
  2⤵
  PID:3716