[kvz3]

Hi all,

I was wondering, how effective is to run malware samples in a real machine and generate memory dumps to overcome packing? The goal is then to analyse the binary statically from the dump.

Thanks!
Kvz3

[EP_X0FF]

Very effective. You don't need a real machine.

[kvz3]

at what point during execution should it be dumped?

[EP_X0FF]

Depends on malware.

[TETYYSs]

at what point during execution should it be dumped?

on the final point it injects the code, often on WriteProcessMemory