2.8 Debugging a Malicious DLL Using x64dbg

In chapter 3, Dynamic Analysis, you learned techniques to execute a DLL to perform dynamic analysis. In this section, you will use some of the concepts that you learned in chapter 3, Dynamic Analysis, to debug a DLL using x64dbg. If you are not already familiar with the dynamic analysis of a DLL, it is highly recommended to read Section 6, Dynamic-Link Library (DLL) Analysis, from Chapter 3, Dynamic Analysis, before proceeding further.

To debug a DLL, launch x64dbg (preferably with administrator privileges) and load the DLL (via File | Open). When you load the DLL, x64dbg drops an executable (named DLLLoader32_xxxx.exewhere xxxx are random hexadecimal characters) into the same directory where your ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.