-1

I want to analyse a malware that do not run without administrative previliges.

I know it is risky but still.

How can I debug it with debugger as from entry point?

Because debugger could not start it as administrator. And I Got error

Error Starting Process (create Process, 00000740, uiAccess="true")

  • 1
    Why not to debug it in isolated environment? Like virtual machine – morsisko Jul 3 at 20:38
1

Some ideas:

  1. Try using Image File Execution Options registry key to automatically run the debugger when the process starts.

  2. Patch an infinite loop (EB FE) at the entry point, start the binary, then attach to it from a debugger started as admin.

  3. Use kernel debugger or hypervisor-based debugger to debug the process without relying on user mode debugging API.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.