socks5systemz | 6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:22

Target

6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6.dll
Size

648KB
MD5

9f272c4667d2d9cb7e79097bc248c88f
SHA1

3f26a7b54cd6a137ac8a7edfd4776756d2c59c15
SHA256

6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6
SHA512

3cd5a772b11c452000eb9c548fd863dd0358dce6440c4cb28b39039bacc60a7962eda4fab0c79d1c52031c1e756d0eeea12e4fdb5d7740999628852f45ee3b44
SSDEEP

12288:HjsgiZdvAeRwV+a4HZ50cCBPBqkPcvpWwF9mxRKLiTOkkRp6HmmkLiIjcBDQg5EC:DsgwdvA8r550cCBPBqkkvpfF9mxR+iTn

Score

10^/10

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1788-0-0x0000000075760000-0x0000000075802000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1652	1788	WerFault.exe	85
2244	1788	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1788	5032	rundll32.exe	85
PID 5032 wrote to memory of 1788	5032	rundll32.exe	85
PID 5032 wrote to memory of 1788	5032	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6.dll,#1
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 604
    3⤵
    - Program crash
    PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 612
    3⤵
    - Program crash
    PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1788 -ip 1788
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1788 -ip 1788
1⤵
PID:3980

memory/1788-0-0x0000000075760000-0x0000000075802000-memory.dmp

Filesize
648KB

Download