Prepare few comparisons for ProcDOT integration

CERT-Polska / drakvuf-sandbox

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

https://drakvuf-sandbox.readthedocs.io/

Other

1.05k stars 143 forks source link

Prepare few comparisons for ProcDOT integration #16

Open icedevml opened 4 years ago

icedevml commented 4 years ago

We do need some material to compare how far we are currently with the ProcDOT integration. This could be basically achieved by dropping a few samples into a VM monitored by procmon, generating graphs and finally comparing these graphs against ones that are generated by our integration.

icedevml commented 4 years ago

Note: On Windows 7, Process Monitor may say:

Unable to load process monitor device driver

This is due to missing KB3033929 update that enables code signing with SHA-2 (used by Process Monitor driver).

Source: https://rspydir.wordpress.com/2017/05/24/solved-unable-to-load-process-monitor-device-driver/