Cracked DLLs modify memory and hook system calls to bypass DRM. This behavior is flagged as "Trojan.Generic" or "HackTool" by Windows Defender and third-party AVs.