I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda.
Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some point(0x4013E6) it modifies itself and turns to completely another program(malicious one).
I'm preety sure that the OEP is at 0x401265. But the problem is - I can not dump the process at this point and it makes the analysis difficult, because I can analyze only in a debugger. I tried to use the OllyDump and it throws the Unable to read memory of debugged process(00400000..00408FFF) followed by Bad DOS Signature!!. I also tried the dump.py in ImmunityDBG but it did not helped.
I also tried to change memory acccess right on every section in Olly before I dumped the process. Unfortunately it was not possible to change it at all sections. Also, consider that this malware sample creates new sections while modifying itself, may be it causes the problem?
If you want to take a look on the malware sample by yourself than set a first hardware breakpoint at 0x40220F(it is where the unpacking stub starts). After that set another one at 0x401265(OEP in my opinion).
It would be great if you count give me a hint how could I dump the process or what am I doing not correctly.
Thank you in advance :-)