914ea214e7d6770e61e0b80288a0b02c073d15c342e8320591b092967d163e8f

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 14:30

Target

AssCreed II Crack/ubiorbitapi_r2.dll
Size

749KB
MD5

86ba92c8c93593d0dac364c8cad2346d
SHA1

9ad987aed677a595cb6cb507a12a014989d4e597
SHA256

79e6323661385f527d3774ec3abc002e402c4e2870ae0d6412c825c7d4556675
SHA512

543b5281bb0e2ffb0b9ad0d105ab00e2b9e1e4531edc658561bc5e9913cf1210ff6a4ae32da9468bfb2c7151b967a386062f9f96296f5afee818a33de5cf3c07
SSDEEP

12288:vNH+1gxr2WF9Bqx8lP2J01htFH/nydD0M9gRcCDtrZnw0Xu5ZGFaw:1H+16r2+9BNt2u1htFH/ny+fdxreku5M

Score

7^/10

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/3244-0-0x00000000752D0000-0x000000007547E000-memory.dmp	vmprotect
behavioral2/memory/3244-1-0x00000000752D0000-0x000000007547E000-memory.dmp	vmprotect
behavioral2/memory/3244-5-0x00000000752D0000-0x000000007547E000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

3244 rundll32.exe

pid	process
3244	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2288 wrote to memory of 3244	2288	rundll32.exe	rundll32.exe
PID 2288 wrote to memory of 3244	2288	rundll32.exe	rundll32.exe
PID 2288 wrote to memory of 3244	2288	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AssCreed II Crack\ubiorbitapi_r2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AssCreed II Crack\ubiorbitapi_r2.dll",#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3244

memory/3244-0-0x00000000752D0000-0x000000007547E000-memory.dmp

Filesize
1.7MB

Download
memory/3244-1-0x00000000752D0000-0x000000007547E000-memory.dmp

Filesize
1.7MB

Download
memory/3244-5-0x00000000752D0000-0x000000007547E000-memory.dmp

Filesize
1.7MB

Download