1

What steps would you suggest for debugging a malware that injects a DLL into explorer.exe?

  • using X32dbg
  • have already attached explorer.exe to x32dbg

1 Answer 1

1

Try to find injector's code. Determine what is the dll (find related code and dump it). Read about how dll is loaded in the process (https://mez0.cc/posts/exploring-dll-loads/) For debug dll you can set breakpoint in DLLMain, when ul_reason_for_call == DLL_PROCESS_ATTACHED.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.