-1

I want to analyse a malware that do not run without administrative previliges.

I know it is risky but still.

How can I debug it with debugger as from entry point?

Because debugger could not start it as administrator. And I Got error

Error Starting Process (create Process, 00000740, uiAccess="true")

1
  • 1
    Why not to debug it in isolated environment? Like virtual machine
    – morsisko
    Jul 3, 2020 at 20:38

1 Answer 1

2

Some ideas:

  1. Try using Image File Execution Options registry key to automatically run the debugger when the process starts.

  2. Patch an infinite loop (EB FE) at the entry point, start the binary, then attach to it from a debugger started as admin.

  3. Use kernel debugger or hypervisor-based debugger to debug the process without relying on user mode debugging API.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.