1

I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the actual payload in memory and took a crash dump at the point where the executable is loaded into memory. Is it safe to open (and not run) the crash dump file in WinDbg in a trusted environment? I will be using WinDbg commands to list peb, TIDs etc.

1 Answer 1

1

In short, yes it is safe. The debuggers won't map crash dumps into executable memory, and extensions such as .call only work in live debugging.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.