Analyzer: if a process is created from a dropped file, capture (dump)…

… the file immediately
kevoreilly · Mar 11, 2024 · 4e89d74 · 4e89d74
1 parent 5c8e4e0
commit 4e89d74
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/analyzer/windows/analyzer.py b/analyzer/windows/analyzer.py
@@ -1284,6 +1284,8 @@ def _handle_process(self, data):
                         interest = filepath
                     else:
                         interest = self.analyzer.config.target
+                    if filepath.lower() in self.analyzer.files.files:
+                        self.analyzer.files.delete_file(file_path, process_id)
                     is_64bit = proc.is_64bit()
                     filename = os.path.basename(filepath)
                     if self.analyzer.SERVICES_PID and process_id == self.analyzer.SERVICES_PID: