Learning Malware Analysis

2.8 Debugging a Malicious DLL Using x64dbg

In chapter 3, Dynamic Analysis, you learned techniques to execute a DLL to perform dynamic analysis. In this section, you will use some of the concepts that you learned in chapter 3, Dynamic Analysis, to debug a DLL using x64dbg. If you are not already familiar with the dynamic analysis of a DLL, it is highly recommended to read Section 6, Dynamic-Link Library (DLL) Analysis, from Chapter 3, Dynamic Analysis, before proceeding further.

To debug a DLL, launch x64dbg (preferably with administrator privileges) and load the DLL (via File | Open). When you load the DLL, x64dbg drops an executable (named DLLLoader32_xxxx.exe, where xxxx are random hexadecimal characters) into the same directory where your ...