yunsip | 86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 23:54

Target

86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4.dll
Size

492KB
MD5

8872555347a5fa0263a1b662a6639f00
SHA1

a0cd4f6333cf397159dcc21ded42390481f001e1
SHA256

86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4
SHA512

41f5782651f657ea411b683f8fc053bcd0f4c6f83989a15a2a87b3e35362975490c4682110c3c5c56b7cc80a527aaaa59a501c38da5f04b6516dae6dcc956bc3
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0m:jDgtfRQUHPw06MoV2nwTBlhm8e

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3468	2184	rundll32.exe	83
PID 2184 wrote to memory of 3468	2184	rundll32.exe	83
PID 2184 wrote to memory of 3468	2184	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86982d6973e68551769b813510d935a9c24729393f7051dd8f72f8e1071ea3e4.dll,#1
  2⤵
  PID:3468