neonprimetime security , just trying to help

Detection Engineering stages of maturity, getting the most out of your SIEM, a story over time #detectionengineering #blueteam #siem The ...

Started with this redline malware sample  https://www.joesandbox.com/analysis/808971/0/html Which the sandbox says dumps a bunch of child-...

 call ds:__imp__FDICreate (creates context for extracting Microsoft .CAB Cabinet files) ... push offset pszCabPath  call ds:__imp__FDICopy Y...

 v0 = FindResourceA(0, "UPROMPT", (LPCSTR)0xA); or push 0xA ; lpType push edi ; lpName push 0 ; hModule call ds:__imp__Findresourc...

CreateProcessInternalW CreationFlags: CREATE_SUSPENDED 0x00000004 Malware creating a process in a suspended state typically from a packer an...

 VirtualProtectEx Protection: PAGE_EXECUTE_READWRITE 0x40 in malware that almost always means "injected code"

 IDA Pro error The graph is too big (more than 1000 nodes) two options as to why the graph is "too big" 1) either it's obfusca...