Overview
overview
4Static
static
3NAudio.dll
windows7-x64
1NAudio.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1ThemeEdito...on.dll
windows7-x64
1ThemeEdito...on.dll
windows10-2004-x64
1ThemeEditor.WPF.exe
windows7-x64
3ThemeEditor.WPF.exe
windows10-2004-x64
3ThirdParty...nt.doc
windows7-x64
4ThirdParty...nt.doc
windows10-2004-x64
1ThirdParty...de.dll
windows7-x64
3ThirdParty...de.dll
windows10-2004-x64
3ThirdParty...-0.dll
windows7-x64
3ThirdParty...-0.dll
windows10-2004-x64
3ThirdParty...is.dll
windows7-x64
3ThirdParty...is.dll
windows10-2004-x64
3ThirdParty...st.exe
windows7-x64
1ThirdParty...st.exe
windows10-2004-x64
3Xceed.Wpf.Toolkit.dll
windows7-x64
1Xceed.Wpf.Toolkit.dll
windows10-2004-x64
1es/ThemeEd...es.dll
windows7-x64
1es/ThemeEd...es.dll
windows10-2004-x64
1fr/ThemeEd...es.dll
windows7-x64
1fr/ThemeEd...es.dll
windows10-2004-x64
1it/ThemeEd...es.dll
windows7-x64
1it/ThemeEd...es.dll
windows10-2004-x64
1pt-BR/Them...es.dll
windows7-x64
1pt-BR/Them...es.dll
windows10-2004-x64
1Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
NAudio.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
NAudio.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Newtonsoft.Json.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ThemeEditor.Common.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
ThemeEditor.Common.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ThemeEditor.WPF.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
ThemeEditor.WPF.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ThirdParty/vgmstream/g7221-siren7_14_G719_license_agreement.doc
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
ThirdParty/vgmstream/g7221-siren7_14_G719_license_agreement.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ThirdParty/vgmstream/libg7221_decode.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
ThirdParty/vgmstream/libg7221_decode.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ThirdParty/vgmstream/libmpg123-0.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
ThirdParty/vgmstream/libmpg123-0.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ThirdParty/vgmstream/libvorbis.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
ThirdParty/vgmstream/libvorbis.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ThirdParty/vgmstream/test.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
ThirdParty/vgmstream/test.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Xceed.Wpf.Toolkit.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
Xceed.Wpf.Toolkit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
es/ThemeEditor.WPF.resources.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
es/ThemeEditor.WPF.resources.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
fr/ThemeEditor.WPF.resources.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
fr/ThemeEditor.WPF.resources.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
it/ThemeEditor.WPF.resources.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
it/ThemeEditor.WPF.resources.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
pt-BR/ThemeEditor.WPF.resources.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
pt-BR/ThemeEditor.WPF.resources.dll
Resource
win10v2004-20240802-en
General
-
Target
ThirdParty/vgmstream/libg7221_decode.dll
-
Size
44KB
-
MD5
157d3967af4cfb89f8cd9a3c7853170c
-
SHA1
b5ed63851923668eb5dee72e6ae3a840ec79c84c
-
SHA256
d2104cb8e08c29f9d0f6c2a1f98c538823ffcd5bff739c81640d70b1b75fa747
-
SHA512
b03a222ba75e5590d4144d26956ee43e8e22844d5b50c8c6c9aeaa3a001b4149a0e1c38d5969886eb6e4c166561c51f4cff6a81039207e9af214ffd480a59227
-
SSDEEP
768:WzlyM4XlKXqV2ZlaqyOz3QIDVw3t41t7FxdxKMtmza+e/HTsGVFz:WzjX22ZryOJAMtp5zz
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2496 3040 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1936 wrote to memory of 3040 1936 rundll32.exe 83 PID 1936 wrote to memory of 3040 1936 rundll32.exe 83 PID 1936 wrote to memory of 3040 1936 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ThirdParty\vgmstream\libg7221_decode.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ThirdParty\vgmstream\libg7221_decode.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 6003⤵
- Program crash
PID:2496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3040 -ip 30401⤵PID:2340