I am working on Lab13-01.exe from "Practical Malware Analysis" (you can download it from here).
When I run it without debuggers in my VMWare it runs without errors.
I started to analyze it with OllyDbg 2.01.
There is some point in the code that it receives exception and I don't understand why.
It has resource that contains encoded string:
LLLKIZXORXZWVZWLZI^ZUZWBHRHXTV
This resource is saved at address 0x408060
At 0x4011C1
it overwrites the first byte of the string with AL (0x77)
:
MOV BYTE PTR DS:[ECX], AL
Then I received:
Access violation when writing to [00408060]
When I press Shift+Run/Step, it succeed to run.
There number of things I don't understand here.
- If it can't write to
[00408060]
, how come when I press Shift+Run/Step it succeed ? - Why it can't write to
[00408060]
? Is there some flag that prevent from writing to this aread (if yes, where can I see it?) ?