5

A piece of malware is running on a Windows 7 machine via process injection, so it does not show up in a process list. What remote forensic technique could be used to discover the malware is running under the contents of a specific process?

Improve this question
2
  • If you have specific process then Process Monitor from Microsoft Sys Internals.
    – Aria
    Commented Aug 9, 2016 at 0:09
  • This didn't happen to be from an Army technical assessment did it? Found this question when looking for help on mine, and it's got the exact same wording lol
    – Noah Miller
    Commented Nov 27, 2016 at 19:12

1 Answer 1

Reset to default
2

I would definitely use Process Mon from Sys Internals as well.

Link: Process Monitor Download Page

I would also look into AutoRuns as well from the same site. If by chance the malware is persistent, AutoRuns will show you whether or not the process is initiated at boot - as well as other useful information. Good luck!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .