As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:
- Being executed
- Decrypt a lot of data from memory and obtain a new PE (from memory)
- Create a child process in suspended state
- Dump the new data obtained into the Created child process
Now one issue i was thinking about, is the fact i dont know what the
EntryPoint is so i dont know what part of the memory bytes i would change to
EB FE (JMP < ToSelf >) To be able to debug the process from the start
Once the new process is created and im attaching a debugger to it - OLLYDbg for that case (And the process is on Pause state) Pressing
F8 - step over causing the application to have a huge delay of like 10 seconds untill the Opcode is finished - which makes no sense.
Also if i watch the newly created process on
Sysinternals - ProcessExplorer I can see that after i press F8 the CPU usage of that process is very high 50-90 for all that time, until the opcode is finished. Which also results in all of the computer to run very slowly
What could cause that? and how would i be able to bypass that?
It does not happen if i dont debug the process.