GhouLSec·Feb 5, 2025[Mal Series #27] NSIS Packed Electron AppMalware analysis on NSIS packed electron application.
GhouLSec·Sep 15, 2024[Misc Series #6] Windbg Remote DebuggingHow to debug user-mode code with Windbg using remote debugging.
GhouLSec·May 22, 2024[Misc Series #5] How Windows CMD and PowerShell Execute a File?This blog will note down some mechanism that Windows implemented to select an application to open a file.
GhouLSec·Jan 4, 2024[Misc Series #4] Forensics on EDRSilencer EventsHere are some of the indicators that we can go for if the EDR telemetry data flow has been “blocked” due to any security events.
GhouLSec·Sep 1, 2023[Mal Series #26] Quick Analysis on Maldoc in PDFQuick analysis on maldoc in PDF from JPCert blog. Some interesting artifcats were found in this case also.
GhouLSec·May 30, 2023[Mal Series #25] The spawn of conhost.exePersonal findings on conhost.exe 0xffffffff -ForceV1
GhouLSec·May 11, 2023[Misc Series #3] Vuln ProcExp 16.32Analysis on how does the vulnerable version of ProcExp driver terminate a process.
GhouLSec·Mar 5, 2023[Mal Series #24] Qakbot BB12 DLL Analysis 2023Qakbot BB12 analysisA response icon1A response icon1
GhouLSec·Jan 13, 2023[Misc Series #2] Debug trick with Image File Execution Options (IFEO)Debug file once it launched with Image File Execution Options (IFEO)
GhouLSec·Dec 20, 2022[RedDev #5] Rundll32 COM Hijack executor in C++Simple explanation on how does the COM executed via rundll32 with switch -sta / -localserverA response icon1A response icon1