systembc | d74c35a72f27144306192ee3ddbfaad92edc42658d5a240c61bd01e2abe283d4

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
10/12/2023, 00:31

Target
91c7cded43648845e8acd59f3fafb6ce4fd5af517eb81a8e12e8c6640c07ff0f.dll
Size 494KB
Sample231210-avfb2abaem
SHA256 91c7cded43648845e8acd59f3fafb6ce4fd5af517eb81a8e12e8c6640c07ff0f
MD5 59d048af2c940a65b683742fc0ee5bbf
SHA1 7bccc3c45e7f476695c0d5b63d63d1a34be59251
SHA512 bee99dee3a817eb02d221a5de5b72e9534fa365bee05ac3adfb12039ae97fe3f8a51ddf3b9ab551e8bd3643ce60e6520269f34598944ece25e88ed012a46dd10
SSDEEP 12288:Q5XyxkU3lXU7QCy62PLxZ1YRmBnRibWZngiM/x:4CxvXU7Qx/9Z1XImi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc trojan

Family

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4360	2176	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2176	3716	rundll32.exe	86
PID 3716 wrote to memory of 2176	3716	rundll32.exe	86
PID 3716 wrote to memory of 2176	3716	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91c7cded43648845e8acd59f3fafb6ce4fd5af517eb81a8e12e8c6640c07ff0f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91c7cded43648845e8acd59f3fafb6ce4fd5af517eb81a8e12e8c6640c07ff0f.dll,#1
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 632
    3⤵
    - Program crash
    PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2176 -ip 2176
1⤵
PID:552

memory/2176-0-0x0000000001530000-0x0000000001536000-memory.dmp

Download

memory/2176-1-0x0000000001550000-0x0000000001557000-memory.dmp

Download

memory/2176-2-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2176-3-0x0000000001530000-0x0000000001536000-memory.dmp

Download