Overview
overview
4Static
static
3Graillon-F...de.pdf
windows7-x64
1Graillon-F...de.pdf
windows10-2004-x64
1Graillon-F...et.pdf
windows7-x64
1Graillon-F...et.pdf
windows10-2004-x64
1Graillon-F...on2.so
ubuntu-18.04-amd64
1Graillon-F...n 2.so
ubuntu-20.04-amd64
1Graillon-F...n 2.so
ubuntu-20.04-amd64
1Graillon-F....0.pkg
macos-10.15-amd64
4Graillon-F....0.exe
windows7-x64
3Graillon-F....0.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PROGRAMFI... 2.dll
windows7-x64
1$PROGRAMFI... 2.dll
windows10-2004-x64
1$PROGRAMFI... 2.dll
windows7-x64
1$PROGRAMFI... 2.dll
windows10-2004-x64
1$PROGRAMFI...64.dll
windows7-x64
1$PROGRAMFI...64.dll
windows10-2004-x64
1$_26_/Aubu...64.dll
windows7-x64
1$_26_/Aubu...64.dll
windows10-2004-x64
1$_27_/Aubu... 2.dll
windows7-x64
3$_27_/Aubu... 2.dll
windows10-2004-x64
3$_28_/Grai...64.dll
windows7-x64
1$_28_/Grai...64.dll
windows10-2004-x64
Graillon-F...e.html
windows7-x64
1Graillon-F...e.html
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 11:55
Static task
static1
Behavioral task
behavioral1
Sample
Graillon-FREE-2.8/Graillon 2 User's Guide.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Graillon-FREE-2.8/Graillon 2 User's Guide.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Graillon-FREE-2.8/Graillon Datasheet.pdf
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Graillon-FREE-2.8/Graillon Datasheet.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
Graillon-FREE-2.8/Linux/Linux-64b-LV2-FREE/Auburn Sounds Graillon 2.lv2/AuburnSoundsGraillon2.so
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral6
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST2-FREE/Auburn Sounds Graillon 2.so
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral7
Sample
Graillon-FREE-2.8/Linux/Linux-64b-VST3-FREE/Auburn Sounds Graillon 2.vst3/Contents/x86_64-linux/Auburn Sounds Graillon 2.so
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral8
Sample
Graillon-FREE-2.8/Mac/Graillon-2-FREE-2.8.0.pkg
Resource
macos-20240410-en
Behavioral task
behavioral9
Sample
Graillon-FREE-2.8/Windows/Graillon-2-FREE-2.8.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Graillon-FREE-2.8/Windows/Graillon-2-FREE-2.8.0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
$PROGRAMFILES/Common Files/VST3/Auburn Sounds Graillon 2.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$PROGRAMFILES/Common Files/VST3/Auburn Sounds Graillon 2.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
$PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/x64/Auburn Sounds Graillon 2.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/x64/Auburn Sounds Graillon 2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$PROGRAMFILES64/Common Files/VST3/Auburn Sounds Graillon 2-64.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$PROGRAMFILES64/Common Files/VST3/Auburn Sounds Graillon 2-64.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
$_26_/Auburn Sounds Graillon 2-64.dll
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
$_26_/Auburn Sounds Graillon 2-64.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
$_27_/Auburn Sounds Graillon 2.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
$_27_/Auburn Sounds Graillon 2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$_28_/Graillon 2/Graillon 2_x64.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$_28_/Graillon 2/Graillon 2_x64.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
Graillon-FREE-2.8/license.html
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
Graillon-FREE-2.8/license.html
Resource
win10v2004-20240412-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
4add245d4ba34b04f213409bfe504c07
-
SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
-
SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
-
SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
SSDEEP
192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1740 1908 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2080 wrote to memory of 1908 2080 rundll32.exe rundll32.exe PID 2080 wrote to memory of 1908 2080 rundll32.exe rundll32.exe PID 2080 wrote to memory of 1908 2080 rundll32.exe rundll32.exe PID 2080 wrote to memory of 1908 2080 rundll32.exe rundll32.exe PID 2080 wrote to memory of 1908 2080 rundll32.exe rundll32.exe PID 2080 wrote to memory of 1908 2080 rundll32.exe rundll32.exe PID 2080 wrote to memory of 1908 2080 rundll32.exe rundll32.exe PID 1908 wrote to memory of 1740 1908 rundll32.exe WerFault.exe PID 1908 wrote to memory of 1740 1908 rundll32.exe WerFault.exe PID 1908 wrote to memory of 1740 1908 rundll32.exe WerFault.exe PID 1908 wrote to memory of 1740 1908 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 2203⤵
- Program crash