In summary, the lib.so file and memory values are closely related in that the former contains the executable code (opcodes) that define the application’s behavior, and the latter represents the runtime state of these codes. Editing the lib.so file alters the program's machine code, while manipulating memory values can change the application’s behavior during execution.
About your question "how can I find it which hack connected to which class?"
Answer : If you mean on memory, then you can scan value using Class Search script and get result of Class name even for games which have obsfucated dump.cs which is very helpful.
Class name and Field offset searcher (#by23kt0q)
Script will show you class name in most of cases like 90%.