The dynamic analysis of process injection is quite tricky. The malware escapes the debugged process into another one in order to run the shellcode or load the DLL. To be able to debug this shellcode successfully, there are some tricks that may help you to debug the injected code.
Dynamic analysis of code injection
Technique 1—debug it where it is
The first technique, which is preferred by many engineers, is to not allow the malware to inject the shellcode but rather to debug the shellcode in the malware memory as if it were already injected. Generally, malware injects its shellcode inside another process and executes it from a specific point in that shellcode. We can locate that shellcode inside the malware binary (or memory...
