Overview

overview

7

Static

static

7

《刺客�...64.dll

windows7-x64

1

《刺客�...64.dll

windows10-2004-x64

1

《刺客�...64.dll

windows7-x64

7

《刺客�...64.dll

windows10-2004-x64

7

《刺客�...64.dll

windows7-x64

7

《刺客�...64.dll

windows10-2004-x64

7

《刺客�...��.url

windows7-x64

1

《刺客�...��.url

windows10-2004-x64

1

Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 01:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    《刺客信条：枭雄》PC版全版本通用破解补丁/Crack/uplay_r1_loader64.dll

  • Size

    887KB

  • MD5

    055144df363703f9e9130d23cd1c602b

  • SHA1

    4ced1ae53339ec00a444007c7c7fac6a85ab3e1e

  • SHA256

    85c219ce4f337cc52efc201f0dcf018a399d976bd2a45d918ead040dc5c9d8ca

  • SHA512

    a5a178fdb5e056ec1045a591cb25739604aa498b46a905b004b655d9e9ede59fc48b24c4e0adeb12b7a94632cdd7a871847e5de8878e023d05490e294b9233cc

  • SSDEEP

    12288:hS+BmebEh4D4qxR4mFm4DkYI4FG4Z+++RZVfiysrGYnEYcYG1ecSRBFQI3n22Vm0:NTysVnescuzQIXXvH

Score
7/10
vmprotect

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • NTFS ADS 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\《刺客信条：枭雄》PC版全版本通用破解补丁\Crack\uplay_r1_loader64.dll,#1
    1⤵
    • NTFS ADS
    PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3176-3-0x00007FFC085A0000-0x00007FFC08618000-memory.dmp

    Filesize

    480KB

    Download

  • memory/3176-0-0x00007FFC085A0000-0x00007FFC08618000-memory.dmp

    Filesize

    480KB

    Download

  • memory/3176-4-0x00007FFC085A0000-0x00007FFC08618000-memory.dmp

    Filesize

    480KB

    Download