Overview

overview

4

Static

static

3

Graillon-F...de.pdf

windows7-x64

1

Graillon-F...de.pdf

windows10-2004-x64

1

Graillon-F...et.pdf

windows7-x64

1

Graillon-F...et.pdf

windows10-2004-x64

1

Graillon-F...on2.so

ubuntu-18.04-amd64

1

Graillon-F...n 2.so

ubuntu-20.04-amd64

1

Graillon-F...n 2.so

ubuntu-20.04-amd64

1

Graillon-F....0.pkg

macos-10.15-amd64

4

Graillon-F....0.exe

windows7-x64

3

Graillon-F....0.exe

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PROGRAMFI... 2.dll

windows7-x64

1

$PROGRAMFI... 2.dll

windows10-2004-x64

1

$PROGRAMFI... 2.dll

windows7-x64

1

$PROGRAMFI... 2.dll

windows10-2004-x64

1

$PROGRAMFI...64.dll

windows7-x64

1

$PROGRAMFI...64.dll

windows10-2004-x64

1

$_26_/Aubu...64.dll

windows7-x64

1

$_26_/Aubu...64.dll

windows10-2004-x64

1

$_27_/Aubu... 2.dll

windows7-x64

3

$_27_/Aubu... 2.dll

windows10-2004-x64

3

$_28_/Grai...64.dll

windows7-x64

1

$_28_/Grai...64.dll

windows10-2004-x64

Graillon-F...e.html

windows7-x64

1

Graillon-F...e.html

windows10-2004-x64

1

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2024 11:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $_28_/Graillon 2/Graillon 2_x64.dll

  • Size

    2.5MB

  • MD5

    9d350aa10c955eaa4676c39a9d9f8384

  • SHA1

    b139da873b89f646e90048a52749f271e4eabf79

  • SHA256

    9b8addd0ab24db5218939f0c2195ed3c55b22c2677f8446b1a52373742f493f4

  • SHA512

    84699a3121f7128ec2976887cf71f1f8ebf22fced707d839ec92267dde4407cc1d5cbc6919d8230741ad650396111bb0fa57cc25d0bd5e95e97281d5440e773f

  • SSDEEP

    49152:8GXUtKP1DJIYRthtOtubOl8bbDVq7V0Y/U6+OMtF:umhqubs8bbZqxsjP

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_28_\Graillon 2\Graillon 2_x64.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2844 -s 116
      2⤵
        PID:2012

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads