Introduction to Sysinternals Suite Tools

1 Introduction

Make a record, the official download address:
https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

It includes commonly used tools for windows malware analysis

1. Autoruns.exe: View the auto-start configuration of each software
2. procdump.exe: dynamic unpacking (dump exe directly from memory)
3. procexp.exe: view (and end) the details of the process, and also directly view the strings of the process in memory
4. tcpview.exe: view information about TCP communication

A brief introduction to more tools is given in Reference 1.

2. Reference

• 1. https://blog.51cto.com/zhaoqingqing/3146707