GIAC
GREM · Question #161
During memory analysis you detect an injected PE image missing the MZ header. What technique is MOST likely?
The correct answer is B. PE header unlinking. See the full explanation below for the reasoning.
Question
During memory analysis you detect an injected PE image missing the MZ header. What technique is MOST likely?
Options
- AThread hijacking
- BPE header unlinking
- CExport parsing
- DHeap obfuscation
How the community answered
(48 responses)- A4% (2)
- B75% (36)
- C15% (7)
- D6% (3)
Community Discussion
No community discussion yet for this question.