readme

2026-06-06 16:14:31 +00:00 · 2021-09-29 16:15:24 +02:00
parent 9ce893b45a
commit d44d3facfe
2 changed files with 1 additions and 1 deletions
@@ -117,7 +117,7 @@ However, no `Abnormal private executable memory` IOC this time. Our fluctuation

 And for the record, `pe-sieve` has no issues with our fluctuating shellcode as well:

-![pe-sieve](images/pe-sieve0.png)
+![pe-sieve](images/pe-sieve1.png)

 So we're able to see already that there are no clear references pointing back to our shellcode, at least memory IOC-wise. But what about that modified `kernel32` IOC?