0

I have a .dmp file for googleupdate.exe process. I wanted to check in WinDbg this process has a certificate or not in order to detect this process has modified or not because this process has tried access lsass.exe multiple time.

How can I check the integrity and also maliciousness of this process in WinDbg? I have just a memory dump from that process and nothing more. I should check it in WinDbg.

1

1 Answer 1

1

In short, the PE loader does not explicitly load up the certificate details into the new process at run-time.

In the binary, the certificates are referenced via the IMAGE_DIRECTORY_ENTRY_SECURITY directory; but they are not in a section that is mapped into virtual memory. The data is instead appended to the file.

You might get lucky and find the cert data has been mapped via a memory mapped file, or if you captured a full kernel dump you might have a copy of it. Otherwise you will have to try and source the file from the computer.

Your best bet is to manually compare the code-in-memory to a valid copy of googleupdate.

Also keep in mind that the source binary could be completely valid, but the behavior changed at run-time (via code injection, etc.). So even if you could easily validate the integrity of the certificate, it wouldn't detect rogue threads, hooked functions, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.