Dynamic Analysis

Resources

• Dll :
  • By epochzero : https://learn.epochzero.net/articles/dll-analysis
  • By malwareintel : https://malwareintel.es/blog/entornos-analisis/procmon-process-hacker-api-monitor/

Commands

• Dll
  • Run

    rundll32.exe c:\samples\obe.dll,test
    rundll32.exe c:\samples\obe.dll

• Noriben

  python3 .\Noriben.py # don't forget to copy Procmon in the same dir 

• SpeakEasy

  speakeasy -t shellcode_ps1.bin -r -a x86

Tools

• SystemInformer : https://systeminformer.io/
• ProcMon : https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
• Noriben : https://github.com/Rurik/Noriben
• FlareFakenet : https://github.com/mandiant/flare-fakenet-ng
• inetsim : https://www.inetsim.org/
• WireShark : https://www.wireshark.org/
• API monitor : http://www.rohitab.com/apimonitor

Notes

General

• Whenever a DLL is loaded, its entry point function gets called (which in turn calls its DLLMain function)
• Most of the time, launching a DLL with rundll32.exe will work fine, but some DLLs check if they are running under a particular process (such as explorer.exe or iexplore.exe) and might change their behavior or terminate themselves if they are running under any other process (including rundll32.exe).