yunsip | c9c2f3ffcffee7ea8ac8de953f8bf51f1acf30a6764c7fb32ea898e5c17c9b1f

Analysis

max time kernel
102s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2024 03:55

Target

602c8e5fbf7414b680b516ccdedf1740N.dll
Size

622KB
MD5

602c8e5fbf7414b680b516ccdedf1740
SHA1

6ee50d91d10ee47ae4772f56cdbdcf14ae2f9d54
SHA256

c9c2f3ffcffee7ea8ac8de953f8bf51f1acf30a6764c7fb32ea898e5c17c9b1f
SHA512

5d98de4ab973d80f6257afd354a7730aeb73844a6a58f8fd547af4d62c82be5b0ee43d737bf618d7fb28fa6f4c7cb87457512598150f9ca14a956abe4829af62
SSDEEP

6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYZ:o6RI1Fo/wT3cJYYYYYYYYYYYYZ

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1256	1300	rundll32.exe	84
PID 1300 wrote to memory of 1256	1300	rundll32.exe	84
PID 1300 wrote to memory of 1256	1300	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\602c8e5fbf7414b680b516ccdedf1740N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\602c8e5fbf7414b680b516ccdedf1740N.dll,#1
  2⤵
  PID:1256