yunsip | b7ba6c64a75827771e2f53a567f42cfdfc0a70059bb269207253f5f3706942fc

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 04:06

Target

1d3d165985392587a0aaa5cdd9f01e50_NeikiAnalytics.dll
Size

1.1MB
MD5

1d3d165985392587a0aaa5cdd9f01e50
SHA1

a17eba2c3cc4ec97dc8510f1632a6bb477b7b6a0
SHA256

b7ba6c64a75827771e2f53a567f42cfdfc0a70059bb269207253f5f3706942fc
SHA512

b45937c393f4d2a0ab2b0f324dc9f83d9a6992150e6415fce5aba07b6818f2047bd20c71e4682694a1e6b9bcad8caf78f15922bbc7240217a0663c0f33599329
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8E

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1956	3000	rundll32.exe	82
PID 3000 wrote to memory of 1956	3000	rundll32.exe	82
PID 3000 wrote to memory of 1956	3000	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3d165985392587a0aaa5cdd9f01e50_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3d165985392587a0aaa5cdd9f01e50_NeikiAnalytics.dll,#1
  2⤵
  PID:1956