yunsip | c485f5d610b6fe546394968587b5fdbb3127653f78f8d885d8eb039e396d83a6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 13:34

Target

ca1959e5e22517dc859cb5fd5adc6ff0N.dll
Size

513KB
MD5

ca1959e5e22517dc859cb5fd5adc6ff0
SHA1

decff744b6e6c2b558b17e61376a6ad5c65d6ab5
SHA256

c485f5d610b6fe546394968587b5fdbb3127653f78f8d885d8eb039e396d83a6
SHA512

5bfeb4af0f8d8d61f6a37373ac93b558a52c8f1e6221d315495d33ca10d28642a6151e5a8afa5099588bafb3dc5bfa7ed692f1d96d37f6edb6ca96adef69643b
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8E

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2456	2148	rundll32.exe	30
PID 2148 wrote to memory of 2456	2148	rundll32.exe	30
PID 2148 wrote to memory of 2456	2148	rundll32.exe	30
PID 2148 wrote to memory of 2456	2148	rundll32.exe	30
PID 2148 wrote to memory of 2456	2148	rundll32.exe	30
PID 2148 wrote to memory of 2456	2148	rundll32.exe	30
PID 2148 wrote to memory of 2456	2148	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca1959e5e22517dc859cb5fd5adc6ff0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca1959e5e22517dc859cb5fd5adc6ff0N.dll,#1
  2⤵
  PID:2456