Kinoco Hacker Hands-on security practice
All challenges In progress
Forensics Level 5 100 points

Detect Process Hollowing Attack

Mission

Compare `process_list.txt` with `image_regions.txt` to detect process hollowing. The target process has a PRIVATE, RWX image-base region and a mismatch between its on-disk and resident hashes.

#forensics#malware#process-hollowing#memory#advanced

Clear it in 3 steps

Not started

  1. Start the environment

  2. Investigate the target

    Available after the environment starts

  3. Submit the flag