-
Notifications
You must be signed in to change notification settings - Fork 461
Open
Description
Sample:
e818738311bc1d540a23f3235d75e5a9d79ee75e8661bf34e54cdb7755e619e3
The implanted PEs are detected, yet, they are dumped as .corrupt_dll
s. The reconstructions fails.
Detected artifacts:
"workingset_scan" : {
"module" : "4d1f9b0000",
"status" : 1,
"has_pe" : 1,
"has_shellcode" : 0,
"is_listed_module" : 0,
"protection" : "40",
"mapping_type" : "MEM_PRIVATE",
"pe_artefacts" : {
"pe_base_offset" : "0",
"sections_hdrs" : "1f8",
"sections_count" : 5,
"is_dll" : 1,
"is_64_bit" : 1
}
}
},
{
"workingset_scan" : {
"module" : "4d21340000",
"status" : 1,
"has_pe" : 1,
"has_shellcode" : 1,
"is_listed_module" : 0,
"protection" : "40",
"mapping_type" : "MEM_PRIVATE",
"pe_artefacts" : {
"pe_base_offset" : "ce8",
"nt_file_hdr" : "ddc",
"sections_hdrs" : "ee0",
"sections_count" : 5,
"is_dll" : 1,
"is_64_bit" : 1
}
}
Dumped artifacts:
artifacts.zip
Metadata
Metadata
Assignees
Labels
No labels