yunsip | 4e854ab408c81e9aad122536a951c0a1eb6223975aa68985dd8a9096087b1ca3

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 21:55

Target

4e854ab408c81e9aad122536a951c0a1eb6223975aa68985dd8a9096087b1ca3.dll
Size

719KB
MD5

66ecca86dd9006dc201c0c6dc3a92a5e
SHA1

ab1da37abe12f1225f6b8aa3cb6c16676cb7f1e1
SHA256

4e854ab408c81e9aad122536a951c0a1eb6223975aa68985dd8a9096087b1ca3
SHA512

a2b0ce116e47b1135141ba6ff45d8fdd968452593c9d7d3cbfec161c45294b39d4cc5243062274aa055d7206df7ae382508a5838a1b4fa62a812070ed6ac6d31
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYS:o6RI1Fo/wT3cJYYYYYYYYYYYYS

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28
PID 2820 wrote to memory of 2632	2820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e854ab408c81e9aad122536a951c0a1eb6223975aa68985dd8a9096087b1ca3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e854ab408c81e9aad122536a951c0a1eb6223975aa68985dd8a9096087b1ca3.dll,#1
  2⤵
  PID:2632