How do I extract or dump injected executable code/payload from malware using the x32dbg trick? My malware sample is injecting an Exe PE file in a legitimate File like "Explorer.exe". How do I dump the File?

1 Answer 1


First of all you can attach x32dbg to the process where PE was injected. Next you must trace the address of allocated memory where the malicious PE was written to. If you got that informations you can select bytes that PE consists of from Dump Window in x32dbg, then Right-Click and select "Dump to file" option.

In my opinion the whole process is even easier with Process Hacker tool, where you have to just spot the address where PE was written and then dump all pages to file.

  • Could you please explain in detail? Thanks a lot! Jan 6 at 2:59
  • This means if the malware injects into "Explorer.exe" then I have to do The Process hacker tool trick on Explorer.exe . Right? Jan 6 at 3:00
  • Find all calls of WinAPI function WriteProcessMemory, determine its arguments. Find the place in code where it is called. This can help you to find injector code, process name and the address.
    – strannyi
    Jan 6 at 9:26
  • @DavidL.Wilson yes, exactly. Because this is the target where code will exist after injection and also after possible unpacking or decrypting routines. That space in "explorer.exe" can be found in "memory" tab of Process Hacker. Moreover it should be marked as "Private" type of memory and its protection flags should be "RX" or "RWX".
    – r4v1ck
    Jan 6 at 9:59
  • @DavidL.Wilson As I said, you have to track down by yourself address of allocated memory space. You can do it by debugging injector. Specificaly you can put a breakpoint on all VirtualAllocEx, VirtualProtect, WriteProcessMemory (as it was stated by strannyi), CreateRemoteThread calls, etc. Take a look at all API functions that are used by malware to perform injections, then put BPs on them.
    – r4v1ck
    Jan 6 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.