systembc | a5c9cf2ec9abeb644cbe33bcf1035f3efb1c5282cbd145abbd3c593eb8449a94

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-02-2023 18:31

Target

4860-133-0x0000000010000000-0x000000001013B000-memory.dll
Size

1.2MB
MD5

e5c9a09b7a3b0bb82302db4ce902855d
SHA1

e9b0bc0a2fe4e790cd090f38ef2ebf237d1b82b3
SHA256

a5c9cf2ec9abeb644cbe33bcf1035f3efb1c5282cbd145abbd3c593eb8449a94
SHA512

ffb324318b08459a4b552466a2b12f0c21d7d20c4c10ab572c55b26674945e53f9d7086d5d73a5472004ca04cef10e3528bff431c8fc9ea2891d20c5664d1ca4
SSDEEP

24576:JZA5Md+xdHP0J6wfwnriXWYXbsdmTHdUHlRRrc5Pi7OQMCeMwVrGOUfp7O:J3SdY6OwriXWQsdmbdelRdkai4eMw5Gk

Score

10^/10

systembc trojan

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1156 1304 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1156	1304	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 844 wrote to memory of 1304	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1304	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1304	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1304	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1304	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1304	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1304	844	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1156	1304	rundll32.exe	WerFault.exe
PID 1304 wrote to memory of 1156	1304	rundll32.exe	WerFault.exe
PID 1304 wrote to memory of 1156	1304	rundll32.exe	WerFault.exe
PID 1304 wrote to memory of 1156	1304	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4860-133-0x0000000010000000-0x000000001013B000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4860-133-0x0000000010000000-0x000000001013B000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 196
3⤵
- Program crash
PID:1156

memory/1156-56-0x0000000000000000-mapping.dmp

Download
memory/1304-54-0x0000000000000000-mapping.dmp

Download
memory/1304-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1304-57-0x0000000010000000-0x000000001013B000-memory.dmp

Filesize
1.2MB

Download