yunsip | fc95ab52b972ce0076904332e06c190407916bddd17d694e2fe64ea54cf4e16f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 06:34

Target

fc95ab52b972ce0076904332e06c190407916bddd17d694e2fe64ea54cf4e16f.dll
Size

605KB
MD5

73a53666479c63c75801e6dfb52c8aea
SHA1

374bd2984cd5c7360946fefb290d268bf2f9c5c1
SHA256

fc95ab52b972ce0076904332e06c190407916bddd17d694e2fe64ea54cf4e16f
SHA512

29a11f6be1caa99d6408e58564556e9257e8091b81b2bc16fafb5d63eca1795ba8431fb77fb8d8d91407ccbdb25c4a84cf49ed9c2fc5e89ed3eb15b8f2d5da54
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYm:o6RI1Fo/wT3cJYYYYYYYYYYYYm

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2056	1500	rundll32.exe	28
PID 1500 wrote to memory of 2056	1500	rundll32.exe	28
PID 1500 wrote to memory of 2056	1500	rundll32.exe	28
PID 1500 wrote to memory of 2056	1500	rundll32.exe	28
PID 1500 wrote to memory of 2056	1500	rundll32.exe	28
PID 1500 wrote to memory of 2056	1500	rundll32.exe	28
PID 1500 wrote to memory of 2056	1500	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc95ab52b972ce0076904332e06c190407916bddd17d694e2fe64ea54cf4e16f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc95ab52b972ce0076904332e06c190407916bddd17d694e2fe64ea54cf4e16f.dll,#1
  2⤵
  PID:2056