systembc | d6a1e00751999d2e03f717c83d28a17e57be56ac076e0a65f37b4c7c54558182

Analysis

max time kernel
135s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2023 03:07

Target

6c04ea279fe9be8143546f933cfc62b4.dll
Size

1.2MB
MD5

6c04ea279fe9be8143546f933cfc62b4
SHA1

f390a4a6bb1f6ff8fe2aade6aef338228952aace
SHA256

d6a1e00751999d2e03f717c83d28a17e57be56ac076e0a65f37b4c7c54558182
SHA512

ee40250e4d2916151a224d433051c9f5d0a07871760e5fde14c0a64cfc68af83b1d2cad43fdbf0b59a72431977dc6b094c60e20a815bdc908f4a80c1be09805f
SSDEEP

24576:TqN2ZgQJC24bHwAVob0jDsL5Dv59JzBXffcOLUnb7z/wQzXMIgfmbaZ1q3QIbBTA:TqN2ZgQJC9bHvGbrzJzBXffcOLUnb7zA

Score

10^/10

systembc trojan

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4248 5112 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4248	5112	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4624 wrote to memory of 5112	4624	rundll32.exe	rundll32.exe
PID 4624 wrote to memory of 5112	4624	rundll32.exe	rundll32.exe
PID 4624 wrote to memory of 5112	4624	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c04ea279fe9be8143546f933cfc62b4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c04ea279fe9be8143546f933cfc62b4.dll,#1
2⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 600
3⤵
- Program crash
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5112 -ip 5112
1⤵
PID:3564

memory/5112-133-0x0000000010000000-0x000000001013E000-memory.dmp

Filesize
1.2MB

Download
memory/5112-134-0x00000000029C0000-0x0000000002AE6000-memory.dmp

Filesize
1.1MB

Download
memory/5112-135-0x0000000001180000-0x0000000001184000-memory.dmp

Filesize
16KB

Download