A PE file hiding inside explorer.exe
Run windows.malfind on a memory image and sort its hits. JIT engines and antivirus make noise; find the private RWX region that holds a whole executable and the shellcode stub beside it.
Briefing
invoice_viewer.exe ran for a few seconds on a finance PC and then exited, yet the machine keeps calling out. The image is cases/fin-pc7/fin-pc7.raw.
malfind reports private memory that is both writable and executable, which is where injected code lives. It also flags browsers and security tools, whose engines do this legitimately. The first bytes of each region tell them apart: 4d 5a is MZ, the start of a Windows executable.
forensics-ws · Memory forensics
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.