yunsip | 86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 23:54

Target

86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4.dll
Size

492KB
MD5

8872555347a5fa0263a1b662a6639f00
SHA1

a0cd4f6333cf397159dcc21ded42390481f001e1
SHA256

86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4
SHA512

41f5782651f657ea411b683f8fc053bcd0f4c6f83989a15a2a87b3e35362975490c4682110c3c5c56b7cc80a527aaaa59a501c38da5f04b6516dae6dcc956bc3
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0m:jDgtfRQUHPw06MoV2nwTBlhm8e

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4.dll,#1
  2⤵
  PID:1884