How do I extract or dump injected executable code/payload from malware using the x32dbg trick? My malware sample is injecting an Exe PE file in a legitimate File like "Explorer.exe". How do I dump the File?
First of all you can attach x32dbg to the process where PE was injected. Next you must trace the address of allocated memory where the malicious PE was written to. If you got that informations you can select bytes that PE consists of from Dump Window in x32dbg, then Right-Click and select "Dump to file" option.
In my opinion the whole process is even easier with Process Hacker tool, where you have to just spot the address where PE was written and then dump all pages to file.