yunsip | 38062d151cc49d604ccd658ccea02472dda0a795c81b8909d38f0f1bb1a4b8a3

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 14:14

Target

0e6107f9a04ba669b94b93ec0236188e_JaffaCakes118.dll
Size

206KB
MD5

0e6107f9a04ba669b94b93ec0236188e
SHA1

565b63596d9199832ada16d7c717223b1301ec02
SHA256

38062d151cc49d604ccd658ccea02472dda0a795c81b8909d38f0f1bb1a4b8a3
SHA512

51bbdb4b8488198d95ab8d70d00192d31f8a091e61b5def0907a8a2a1cc49c53ebbf6e716b8982b8f166fa26d16a1fd60d8b89b7235ea0df8f5428ce09c0b3ce
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0Q:jDgtfRQUHPw06MoV2nwTBlhm8I

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4316	4532	rundll32.exe	81
PID 4532 wrote to memory of 4316	4532	rundll32.exe	81
PID 4532 wrote to memory of 4316	4532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e6107f9a04ba669b94b93ec0236188e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e6107f9a04ba669b94b93ec0236188e_JaffaCakes118.dll,#1
  2⤵
  PID:4316