8fe71fbb3d8e60f42a4199c7c667c61bfcfe3bdaece1fb6b92f5aec85313359d

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:07

Target

《刺客信条：枭雄》PC版全版本通用破解补丁/Crack/uplay_r1_loader64.dll
Size

136KB
MD5

fd7d7540b3b2fa54cccdac4d05773680
SHA1

c071694a24580eed1e539893da44b8633c7725ef
SHA256

e9d865f660e3e97e7710c97731ab7cf52cab40e53d8f80bbc7d73f3ee62d0d2d
SHA512

4aea9fa24a9999e7687e43914f3976ec15834290914363dcaa8aaf2445629254dcf91883dfb2681ebd92cad57bb69cf258fef8d47af759e150848adb7f46574d
SSDEEP

3072:XgXMZdeO7JIp2yi6KtQsjBINth15kErMfR2CK/cIUgqkKE:oKdZJke6KBjWNthPkEYjK/jHK

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral5/memory/2028-0-0x000007FEF69F0000-0x000007FEF6A68000-memory.dmp	vmprotect
behavioral5/memory/2028-4-0x000007FEF69F0000-0x000007FEF6A68000-memory.dmp	vmprotect

NTFS ADS 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\«????:??»PC??????????\Crack\save3dmgames\saves.ini rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\«????:??»PC??????????\Crack\save3dmgames\saves.ini	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 2864	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2864	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 2864	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2028 -s 64
2⤵
PID:2864

memory/2028-0-0x000007FEF69F0000-0x000007FEF6A68000-memory.dmp

Filesize
480KB

Download
memory/2028-5-0x000007FEF6A70000-0x000007FEF6AE8000-memory.dmp

Filesize
480KB

Download
memory/2028-3-0x000007FEF6A70000-0x000007FEF6AE8000-memory.dmp

Filesize
480KB

Download
memory/2028-4-0x000007FEF69F0000-0x000007FEF6A68000-memory.dmp

Filesize
480KB

Download
memory/2028-6-0x000007FEF6A70000-0x000007FEF6AE8000-memory.dmp

Filesize
480KB

Download