GIAC
GREM · Question #123
A malware dynamically allocates RWX memory and copies code into it. What is the BEST indication for next analysis step?
The correct answer is B. Dump the memory region. See the full explanation below for the reasoning.
Question
A malware dynamically allocates RWX memory and copies code into it. What is the BEST indication for next analysis step?
Options
- ABreakpoint on WriteFile
- BDump the memory region
- CHash comparison
- DExamine TLS callbacks
How the community answered
(24 responses)- A13% (3)
- B75% (18)
- C8% (2)
- D4% (1)
Community Discussion
No community discussion yet for this question.