312-49 · Question #652
Which of the following Perl scripts will help an investigator to access the executable image of a process?
The correct answer is D. Lspi.pl. Lspi.pl (List Process Information) is a Perl script used in Windows forensic investigations to enumerate running processes and retrieve details including the executable image path (the full file path of the binary running as the process). This is valuable for identifying maliciou
Question
Which of the following Perl scripts will help an investigator to access the executable image of a process?
Options
- ALspd.pl
- BLpsi.pl
- CLspm.pl
- DLspi.pl
How the community answered
(41 responses)- A7% (3)
- B2% (1)
- C2% (1)
- D88% (36)
Explanation
Lspi.pl (List Process Information) is a Perl script used in Windows forensic investigations to enumerate running processes and retrieve details including the executable image path (the full file path of the binary running as the process). This is valuable for identifying malicious processes masquerading under legitimate names. Lspm.pl is used to list process modules (DLLs loaded by a process), while Lspd.pl and Lpsi.pl serve different investigative purposes. For accessing the executable image specifically, Lspi.pl is the correct tool.
Topics
Community Discussion
No community discussion yet for this question.