Learning Malware Analysis

2.2 Attaching to an Existing Process Using x64dbg

To attach to an existing process in x64dbg, select File | Attach (or Alt + A); this will bring up a dialog displaying the running processes, as follows. Choose the process that you wish to debug and click on the Attach button. When the debugger is attached, the process is suspended, giving you time to set breakpoints and inspect the process's resources. When you close the debugger, the attached process will terminate. If you do not want the attached process to terminate, you can detach a process by selecting File | Detach (Ctrl + Alt + F2); this ensures that the attached process is not terminated when you close the debugger:

Sometimes, when you try attaching the debugger to a process, you ...