yunsip | ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 11:06

Target

ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862.dll
Size

508KB
MD5

ca75f031ad969647c232eca59552b0c0
SHA1

5dad46c24b47e53e313f22d3b874aed432df9eb3
SHA256

ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862
SHA512

69433de8471bd10944e8421d1c5c18da8f9bf7c58f704ced18b3a20cfac076893d5d69985edbc5d24e23cb09d8b461ea288d2826f4fd0248306fdd351ab812e7
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q01:jDgtfRQUHPw06MoV2nwTBlhm89

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28
PID 1996 wrote to memory of 2184	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac663c1dccf3868c4a2e3ee6bc16c3c5dd351c9abbb93313f45f5ef51154d862.dll,#1
  2⤵
  PID:2184