YARA unknown stable yara

DebuggerCheck__MemoryWorkingSet [antidebug_antivm]

Anti-debug process memory working set size check

View Source

Detection Logic

pe.imports("kernel32.dll", "K32GetProcessMemoryInfo") and
		pe.imports("kernel32.dll", "GetCurrentProcess")

Field Validations

Loading…

Comments (0)

Loading comments...