Looking For Hidden Module?

[oguzhane]

As you can see there is a injected dll in process and it creates hidden thread , how can i detect this dll ? i have tried enum modules but it didn't work. Ideas??

[XxharCs]

How do you enumerate the process?

[vBulletiin]

Give some more Informations like how you do the Proc?

[dasschild]

Well the problem is the Dll is cloaked. In backend the enumeration of modules will look through the PEB(Process Enviroment Block). Theres a linked list for the modules(forward & backward). So Its unlikely youll find It unless the cloaking is done really bad.

You can just analyse the memory. You have two options you can do. I'm not going into detail as you should figure out itself.