yunsip | d3ce317cc82c3482c09bfb84e0a30a171f913a9b2f1109c1cb79580ccfc67eaa

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 02:55

Target

d3ce317cc82c3482c09bfb84e0a30a171f913a9b2f1109c1cb79580ccfc67eaa.dll
Size

903KB
MD5

af9b126aad0e5e3f958060ab1613db97
SHA1

ea8ed35d8284bda1193323be217cdda2d81c076f
SHA256

d3ce317cc82c3482c09bfb84e0a30a171f913a9b2f1109c1cb79580ccfc67eaa
SHA512

74da3589897dcaf454fb05cc9167b19b605c7c808b174b7a25cee2e8c678fc877e5d777d5c5dfd0bf2b1e0625cc99ffba03699b85541d21896a1a0eb24e8b941
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY2jjjjjjjjjjjjjjjjjjjjjjY:o6RI1Fo/wT3cJYYYYYYYYYYYYv

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1468 wrote to memory of 636	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 636	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 636	1468	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3ce317cc82c3482c09bfb84e0a30a171f913a9b2f1109c1cb79580ccfc67eaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3ce317cc82c3482c09bfb84e0a30a171f913a9b2f1109c1cb79580ccfc67eaa.dll,#1
2⤵
PID:636