What steps would you suggest for debugging a malware that injects a DLL into explorer.exe?
- using X32dbg
- have already attached explorer.exe to x32dbg
Try to find injector's code. Determine what is the dll (find related code and dump it). Read about how dll is loaded in the process (https://mez0.cc/posts/exploring-dll-loads/) For debug dll you can set breakpoint in DLLMain, when ul_reason_for_call == DLL_PROCESS_ATTACHED.