Learning Malware Analysis

4.1.2 Dumping Process Memory With Scylla

Now that we have located the OEP, the next step is to dump the process memory to disk. To dump the process, we will use a tool named Scylla (https://github.com/NtQuery/Scylla); it is a great tool to dump the process memory and to rebuild the import address table. One of the great features of x64dbg is that it integrates Scylla, and Scylla can be launched by clicking on Plugins | Scylla, (or Ctrl + I). To dump the process memory, while the execution is paused at the OEP, launch Scylla, make sure that the OEP field is set to correct address as follows; if not you need to set it manually and click on the Dump button and save the dumped executable to disk (in this case, it was saved as packed_dump.exe ...