search

hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
3.01k stars 421 forks source link

ntdll, user32dll #41

Closed danielpe18 closed 4 years ago

danielpe18 commented 5 years ago

after scanning a lot of processes it finds both of these dll's as suspicious and hooked into a lot of processes, guessing this is probably a false positive but just asking to make sure :)

hasherezade commented 5 years ago

can you share something more? reports, dumps? they could have been hooked by your AV (see FAQ). but without seeing details it is hard to me to find what exactly happened.