forensicsmedium
Gift Abuser
hackerlab
Task: a ZIP archive contains a 2 GiB VMware Windows memory dump with suspicious desktop executables and injected process artifacts. Solution: trace a hollowed svchost.exe back to the dropped GUI payload, extract its transformed data blob, and XOR it with 0x41 to recover the flag.
$ ls tags/ techniques/
memory_dump_triageprocess_hollowing_detectionpe_correlationxor_blob_decoding
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]