Malware Analysis – Process Hollowing
https://www.ispeech.org/text.to.speech
We unpack a Dridex sample that uses process hollowing for memory execution.
Follow me on Twitter: @struppigel
Sample: https://www.hybrid-analysis.com/sample/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc?environmentId=100
Dridex article: https://countuponsecurity.com/2015/12/07/malware-analysis-dridex-process-hollowing/
Process hollowing: http://www.autosectools.com/Process-Hollowing.pdf
API Monitor: http://www.rohitab.com/apimonitor
2017-04-14 05:20:01
source
Gloss