u/CuteLittlePolarBearin r/ReverseEngineering • Recommends
Malware Analysis - Code Injection via CreateRemoteThread & WriteProcessMemory
0:00 / 0:00
#codeinjection#createremotethread#writeprocessmemory
Malware Analysis - Code Injection via CreateRemoteThread & WriteProcessMemory
MalwareAnalysisForHedgehogs
30K subscribers • 11 videos on Hallway
- Recommended by 1 person: 1 in engineering communities.
Intermediate. Assumes working knowledge.
12K views9 years ago1 recommendation
SecurityReverse engineeringExploits and vulnerabilitiesWeb and application security
A walkthrough of analyzing the Gatak malware to see how it uses WriteProcessMemory and CreateRemoteThread to inject code.
We take a look into the malware Gatak which uses WriteProcessMemory and CreateRemoteThread to inject code into rundll32.exe. Many thanks to @_jsoo_ for providing the sample! Malware analysis courses: malwareanalysis-for-hedgehogs.learnworlds.com/courses Buy me a coffee: ko-fi.com/struppigel Follow me on Twitter: twitter.com/struppigel Gatak VirusBtn article: virusbulletin.com/virusbulletin/2016/04/how-it-works-stegano… Sample HA: hybrid-analysis.com/sample/638554093bfbd55f65b42eb86a9d11ecf… Sample Any Run: app.any.run/tasks/80896885-8b9b-4f0f-93c1-dabc5f39577c API Monitor: rohitab.com/apimonitor Process Explorer: technet.microsoft.com/en-us/sysinternals/processexplorer.asp… x64dbg: x64dbg.com/ HxD: mh-nexus.de/en/hxd/Why it's here
1 person recommends thisWhat people say. Recommended as a clear tutorial on analyzing Windows code injection techniques in malware.