DiscoverOALabsReverse Engineering Quick Tip - Unpacking Process Injection With a Single Breakpoint
Reverse Engineering Quick Tip - Unpacking Process Injection With a Single Breakpoint

Reverse Engineering Quick Tip - Unpacking Process Injection With a Single Breakpoint

Update: 2019-04-14
Share

Description

Use x64dbg to unpack malware that uses process injection with a single breakpoint on WriteProcessMemory. Debugging has never been so easy...

Malware sample:
7e7d0557cc95e3f509f71a72aad9b8ab85d6a681df4a46e1648e928a4be5f4be

CAPE Sandbox (for download and analysis):
https://cape.contextis.com/analysis/65348/#

Feedback, questions, and suggestions are always welcome : )

Sergei https://twitter.com/herrcore
Sean https://twitter.com/seanmw

As always check out our tools, tutorials, and more content over at https://www.openanalysis.net


#MalwareAnalysis #Debugging #Unpacking
Comments 
00:00
00:00
x

0.5x

0.8x

1.0x

1.25x

1.5x

2.0x

3.0x

Sleep Timer

Off

End of Episode

5 Minutes

10 Minutes

15 Minutes

30 Minutes

45 Minutes

60 Minutes

120 Minutes

Reverse Engineering Quick Tip - Unpacking Process Injection With a Single Breakpoint

Reverse Engineering Quick Tip - Unpacking Process Injection With a Single Breakpoint

OALabs