yunsip | 5bdfacc7f34de8e40e156a4df44e30b5f340f3a7949f2a0622b7fa139cd6e61a

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 15:32

Target

3df1ebd9adc61e2fbbcf33b7c6cbf9a8_JaffaCakes118.dll
Size

209KB
MD5

3df1ebd9adc61e2fbbcf33b7c6cbf9a8
SHA1

34eab9b17ed05d15e072df03638bbf239f30fe52
SHA256

5bdfacc7f34de8e40e156a4df44e30b5f340f3a7949f2a0622b7fa139cd6e61a
SHA512

9a5117346d564169fbb943a88ab9ae3235fd80ff5d030135cbcf390d3e424e0ceb940f87ff8debd337ee1df5972aacf59dbbd8e091641b41c7d817e98e72f338
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q04:jDgtfRQUHPw06MoV2nwTBlhm8Q

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2756	1644	rundll32.exe	82
PID 1644 wrote to memory of 2756	1644	rundll32.exe	82
PID 1644 wrote to memory of 2756	1644	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3df1ebd9adc61e2fbbcf33b7c6cbf9a8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3df1ebd9adc61e2fbbcf33b7c6cbf9a8_JaffaCakes118.dll,#1
  2⤵
  PID:2756