Thread: Strange question about CreateRemoteThread
View Single Post
  #1  
Old 06-04-2020, 23:35
DavidXanatos DavidXanatos is offline
Family
  
Join Date: Jun 2018
Posts: 179
Rept. Given: 2
Rept. Rcvd 46 Times in 32 Posts
Thanks Given: 58
Thanks Rcvd at 351 Times in 116 Posts
DavidXanatos Reputation: 46
Strange question about CreateRemoteThread
Hi,

I have noticed that when I create a process in a suspended state and use CreateRemoteThread to load a dll (using LoadLibraryA) into that process, after the call to CreateRemoteThread even when the dllmain o the library is set to do nothing in addition to the 1 main thread and the one on purpose created thread I see 3 more appear with the start address ntdll.dll!RtlInitializeResource+0x410 why?!
And can I somehow avoid that?
Reply With Quote