After you run the malware, pop-up messages are displayed on the screen every minute.
The process being injected is explorer.exe.
You can restart the explorer.exe process.
The malware performs DLL injection to launch Lab12-01.dll within explorer.exe. Once Lab12-01.dll is injected, it displays a message box on the screen every minute with a counter that shows how many minutes have elapsed.
Let’s begin with basic static analysis. Examining the imports for
Lab12-01.exe, we see
VirtualAllocEx. Based on the discussion in Chapter 12, we know that we are probably dealing with some form of process injection. Therefore, our first goal should be to determine the code ...