8fe71fbb3d8e60f42a4199c7c667c61bfcfe3bdaece1fb6b92f5aec85313359d

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:07

Target

《刺客信条：枭雄》PC版全版本通用破解补丁/Crack/uplay_r1_loader64.dll
Size

887KB
MD5

055144df363703f9e9130d23cd1c602b
SHA1

4ced1ae53339ec00a444007c7c7fac6a85ab3e1e
SHA256

85c219ce4f337cc52efc201f0dcf018a399d976bd2a45d918ead040dc5c9d8ca
SHA512

a5a178fdb5e056ec1045a591cb25739604aa498b46a905b004b655d9e9ede59fc48b24c4e0adeb12b7a94632cdd7a871847e5de8878e023d05490e294b9233cc
SSDEEP

12288:hS+BmebEh4D4qxR4mFm4DkYI4FG4Z+++RZVfiysrGYnEYcYG1ecSRBFQI3n22Vm0:NTysVnescuzQIXXvH

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral3/memory/2768-1-0x000007FEF75B0000-0x000007FEF7628000-memory.dmp	vmprotect
behavioral3/memory/2768-3-0x000007FEF75B0000-0x000007FEF7628000-memory.dmp	vmprotect
behavioral3/memory/2768-7-0x000007FEF75B0000-0x000007FEF7628000-memory.dmp	vmprotect

NTFS ADS 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\«????:??»PC??????????\Crack\save3dmgames\saves.ini rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\«????:??»PC??????????\Crack\save3dmgames\saves.ini	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2768 wrote to memory of 620	2768	rundll32.exe	WerFault.exe
PID 2768 wrote to memory of 620	2768	rundll32.exe	WerFault.exe
PID 2768 wrote to memory of 620	2768	rundll32.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2768 -s 64
2⤵
PID:620

memory/2768-0-0x000007FEF7630000-0x000007FEF76A8000-memory.dmp

Filesize
480KB

Download
memory/2768-2-0x000007FEF7630000-0x000007FEF76A8000-memory.dmp

Filesize
480KB

Download
memory/2768-1-0x000007FEF75B0000-0x000007FEF7628000-memory.dmp

Filesize
480KB

Download
memory/2768-3-0x000007FEF75B0000-0x000007FEF7628000-memory.dmp

Filesize
480KB

Download
memory/2768-6-0x000007FEF7630000-0x000007FEF76A8000-memory.dmp

Filesize
480KB

Download
memory/2768-7-0x000007FEF75B0000-0x000007FEF7628000-memory.dmp

Filesize
480KB

Download