914ea214e7d6770e61e0b80288a0b02c073d15c342e8320591b092967d163e8f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 14:30

Target

AssCreed II Crack/ubiorbitapi_r2.dll
Size

749KB
MD5

86ba92c8c93593d0dac364c8cad2346d
SHA1

9ad987aed677a595cb6cb507a12a014989d4e597
SHA256

79e6323661385f527d3774ec3abc002e402c4e2870ae0d6412c825c7d4556675
SHA512

543b5281bb0e2ffb0b9ad0d105ab00e2b9e1e4531edc658561bc5e9913cf1210ff6a4ae32da9468bfb2c7151b967a386062f9f96296f5afee818a33de5cf3c07
SSDEEP

12288:vNH+1gxr2WF9Bqx8lP2J01htFH/nydD0M9gRcCDtrZnw0Xu5ZGFaw:1H+16r2+9BNt2u1htFH/ny+fdxreku5M

Score

7^/10

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2956-1-0x0000000074D30000-0x0000000074EDE000-memory.dmp	vmprotect
behavioral1/memory/2956-2-0x0000000074D30000-0x0000000074EDE000-memory.dmp	vmprotect
behavioral1/memory/2956-6-0x0000000074D30000-0x0000000074EDE000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2956 rundll32.exe

pid	process
2956	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2956	2180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AssCreed II Crack\ubiorbitapi_r2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AssCreed II Crack\ubiorbitapi_r2.dll",#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2956

memory/2956-1-0x0000000074D30000-0x0000000074EDE000-memory.dmp

Filesize
1.7MB

Download
memory/2956-0-0x0000000074EE0000-0x000000007508E000-memory.dmp

Filesize
1.7MB

Download
memory/2956-2-0x0000000074D30000-0x0000000074EDE000-memory.dmp

Filesize
1.7MB

Download
memory/2956-6-0x0000000074D30000-0x0000000074EDE000-memory.dmp

Filesize
1.7MB

Download