Strange question about CreateRemoteThread

		Exetools > General > General Discussion
Strange question about CreateRemoteThread

06-04-2020, 23:35

DavidXanatos DavidXanatos is offline

Family

Join Date: Jun 2018

Posts: 183

Rept. Given: 3

Rept. Rcvd 47 Times in 33 Posts

Thanks Given: 59

Thanks Rcvd at 363 Times in 120 Posts

Strange question about CreateRemoteThread

Hi,

I have noticed that when I create a process in a suspended state and use CreateRemoteThread to load a dll (using LoadLibraryA) into that process, after the call to CreateRemoteThread even when the dllmain o the library is set to do nothing in addition to the 1 main thread and the one on purpose created thread I see 3 more appear with the start address ntdll.dll!RtlInitializeResource+0x410 why?!
And can I somehow avoid that?

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Strange RSA modulus N value	TempoMat	General Discussion	8	12-22-2017 10:36

All times are GMT +8. The time now is 02:55.