systembc | d6a1e00751999d2e03f717c83d28a17e57be56ac076e0a65f37b4c7c54558182

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-04-2023 06:03

Target

6c04ea279fe9be8143546f933cfc62b4.dll
Size

1.2MB
MD5

6c04ea279fe9be8143546f933cfc62b4
SHA1

f390a4a6bb1f6ff8fe2aade6aef338228952aace
SHA256

d6a1e00751999d2e03f717c83d28a17e57be56ac076e0a65f37b4c7c54558182
SHA512

ee40250e4d2916151a224d433051c9f5d0a07871760e5fde14c0a64cfc68af83b1d2cad43fdbf0b59a72431977dc6b094c60e20a815bdc908f4a80c1be09805f
SSDEEP

24576:TqN2ZgQJC24bHwAVob0jDsL5Dv59JzBXffcOLUnb7z/wQzXMIgfmbaZ1q3QIbBTA:TqN2ZgQJC9bHvGbrzJzBXffcOLUnb7zA

Score

10^/10

systembc trojan

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1544 wrote to memory of 1568	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1568	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1568	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1568	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1568	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1568	1544	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 1568	1544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c04ea279fe9be8143546f933cfc62b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c04ea279fe9be8143546f933cfc62b4.dll,#1
2⤵
PID:1568

memory/1568-54-0x0000000010000000-0x000000001013E000-memory.dmp

Filesize
1.2MB

Download
memory/1568-55-0x0000000000A20000-0x0000000000B46000-memory.dmp

Filesize
1.1MB

Download
memory/1568-56-0x0000000000130000-0x0000000000134000-memory.dmp

Filesize
16KB

Download