Learning Malware Analysis

11.1 Analyzing 32-bit Executable On 64-bit Windows

The 64-bit Windows operating system can run a 32-bit executable; to do that, Windows developed a subsystem called WOW64 (Windows 32-bit on Windows 64-bit). WOW64 subsystem allows for the execution of 32-bit binaries on 64-bit Windows. When you run an executable, it needs to load the DLLs to call the API functions to interact with the system. The 32-bit executable cannot load 64-bit DLLs (and a 64-bit process cannot load 32-bit DLLs), so Microsoft separated the DLLs for both 32-bit and 64-bit. The 64-bit binaries are stored in the \Windows\system32 directory, and the 32-bit binaries are stored in the \Windows\Syswow64 directory.

The 32-bit applications, when running under 64-bit Windows (Wow64), ...