8fe71fbb3d8e60f42a4199c7c667c61bfcfe3bdaece1fb6b92f5aec85313359d

Analysis

max time kernel
130s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:07

Target

《刺客信条：枭雄》PC版全版本通用破解补丁/Crack/uplay_r1_loader64.dll
Size

136KB
MD5

fd7d7540b3b2fa54cccdac4d05773680
SHA1

c071694a24580eed1e539893da44b8633c7725ef
SHA256

e9d865f660e3e97e7710c97731ab7cf52cab40e53d8f80bbc7d73f3ee62d0d2d
SHA512

4aea9fa24a9999e7687e43914f3976ec15834290914363dcaa8aaf2445629254dcf91883dfb2681ebd92cad57bb69cf258fef8d47af759e150848adb7f46574d
SSDEEP

3072:XgXMZdeO7JIp2yi6KtQsjBINth15kErMfR2CK/cIUgqkKE:oKdZJke6KBjWNthPkEYjK/jHK

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral6/memory/456-0-0x00007FFA05E80000-0x00007FFA05EF8000-memory.dmp	vmprotect
behavioral6/memory/456-3-0x00007FFA05E80000-0x00007FFA05EF8000-memory.dmp	vmprotect

NTFS ADS 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\«????:??»PC??????????\Crack\save3dmgames\saves.ini rundll32.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\«????:??»PC??????????\Crack\save3dmgames\saves.ini	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\《刺客信条：枭雄》PC版全版本通用破解补丁\Crack\uplay_r1_loader64.dll,#1
1⤵
- NTFS ADS
PID:456

memory/456-0-0x00007FFA05E80000-0x00007FFA05EF8000-memory.dmp

Filesize
480KB

Download
memory/456-3-0x00007FFA05E80000-0x00007FFA05EF8000-memory.dmp

Filesize
480KB

Download