If malware creates a new process, new process needs to be analyzed as well. CreateProcess: This function creates and launches a new process.It is a part of the Microsoft C Runtime Library.Īnd we can see some unwanted function calls.

Msvcrt.dll is a module containing standard C library functions such as printf, memcpy, and cos. dll file allows applications to communicate. It is a small program that relates to software processes, similarly to EXE files, but instead of giving commands, the. dll is a dynamically linked library that is used to handle network connections. dll file is a 32-bit dynamic link library file used in Windows to handle memory management, input/output operations, interrupts, synchronization, and process creation. Kernel32.dll, ws2_32.dll, msvcrt.dll this libraries are the malware used. in the import section we can see that the libraries and functions which the malware is used It collects all the data related to that executable. Here I am using the PEstudio to analyze the Portable executable.

Pestudio portable