systembc | 821818e91d3203811e03830420c58065c6e2ef5d1b8f71f25bfb4be671540da5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2023 10:54

Target

940-56-0x0000000010000000-0x0000000010177000-memory.dll
Size

1.5MB
MD5

2d31293c421369b7161ad93a29d6c9ce
SHA1

380d757276880be16ad4927f90ace25bb3e56578
SHA256

821818e91d3203811e03830420c58065c6e2ef5d1b8f71f25bfb4be671540da5
SHA512

feaf4bad3a792cd18dcfa0328c0161e7f427a6f38d5646ea2feb368185b8c8b5c5ed4eb2887be292acf56dc35da199c90250c62e45ebc08e2be0e5f5b0479e16
SSDEEP

24576:CazXgPltxX913tS4Ka8yskqoSXMmBIvgHJOKiNFHyoovI/jto:CaDgdtn13nKFyMoS8mB4gHJOJFSVvIr

Score

10^/10

systembc trojan

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 3036 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1728	3036	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2096 wrote to memory of 3036	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 3036	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 3036	2096	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\940-56-0x0000000010000000-0x0000000010177000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\940-56-0x0000000010000000-0x0000000010177000-memory.dll,#1
2⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 552
3⤵
- Program crash
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3036 -ip 3036
1⤵
PID:3452

memory/3036-132-0x0000000000000000-mapping.dmp

Download
memory/3036-133-0x0000000010000000-0x0000000010177000-memory.dmp

Filesize
1.5MB

Download