systembc | a5c9cf2ec9abeb644cbe33bcf1035f3efb1c5282cbd145abbd3c593eb8449a94

Analysis

max time kernel
152s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2023 18:31

Target

4860-133-0x0000000010000000-0x000000001013B000-memory.dll
Size

1.2MB
MD5

e5c9a09b7a3b0bb82302db4ce902855d
SHA1

e9b0bc0a2fe4e790cd090f38ef2ebf237d1b82b3
SHA256

a5c9cf2ec9abeb644cbe33bcf1035f3efb1c5282cbd145abbd3c593eb8449a94
SHA512

ffb324318b08459a4b552466a2b12f0c21d7d20c4c10ab572c55b26674945e53f9d7086d5d73a5472004ca04cef10e3528bff431c8fc9ea2891d20c5664d1ca4
SSDEEP

24576:JZA5Md+xdHP0J6wfwnriXWYXbsdmTHdUHlRRrc5Pi7OQMCeMwVrGOUfp7O:J3SdY6OwriXWQsdmbdelRdkai4eMw5Gk

Score

10^/10

systembc trojan

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4392 2120 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4392	2120	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2376 wrote to memory of 2120	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2120	2376	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2120	2376	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4860-133-0x0000000010000000-0x000000001013B000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4860-133-0x0000000010000000-0x000000001013B000-memory.dll,#1
2⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 560
3⤵
- Program crash
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2120 -ip 2120
1⤵
PID:2520

memory/2120-132-0x0000000000000000-mapping.dmp

Download
memory/2120-133-0x0000000010000000-0x000000001013B000-memory.dmp

Filesize
1.2MB

Download