0

enter image description hereI'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.

Improve this question
2
  • What / where are you disassembling / data ? The disassembly looks invalid ins outs etc are dos era instructions and wouldnt be valid in a 64 bit user mode app
    – blabb
    Jun 2 at 6:30
  • What does it mean and how did it happen?
    – Invulnerable Immortal
    Jun 3 at 9:04

1 Answer 1

Reset to default
0

As i commented the area you are disassembling does not look like a valid code

As to how did it happen you should know better you have provided the address for disassembling 0x7ffc6b54000 and that address is probably located in advapi32.dll's resource section in the virtual address space of the process

Improve this answer
1
  • I just thought that it was something different. I actually don't know anything, I'm new to this.
    – Invulnerable Immortal
    Jun 19 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.