Detect DLL Injection in Memory
forensics · medium · +45 XP
Target
GET /api/lab/dll-inject-101/memdump (process list + loaded DLLs + suspicious flags)
POST /api/lab/dll-inject-101/submit body {pid, dll_path}
Goal: one process has an unsigned DLL loaded from \AppData\ instead of \System32\ AND a private-mem region with PAGE_EXECUTE_READWRITE permissions. Submit its pid + the malicious dll_path.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/dll-inject-101/
// reuse on the cli
// submit flag
// no solves yet
8 of 13 · forensics