Strange question about CreateRemoteThread

		Exetools > General > General Discussion
Strange question about CreateRemoteThread

06-04-2020, 23:35

DavidXanatos DavidXanatos is offline

Family

Join Date: Jun 2018

Posts: 179

Rept. Given: 2

Rept. Rcvd 46 Times in 32 Posts

Thanks Given: 58

Thanks Rcvd at 351 Times in 116 Posts

Strange question about CreateRemoteThread

Hi,

I have noticed that when I create a process in a suspended state and use CreateRemoteThread to load a dll (using LoadLibraryA) into that process, after the call to CreateRemoteThread even when the dllmain o the library is set to do nothing in addition to the 1 main thread and the one on purpose created thread I see 3 more appear with the start address ntdll.dll!RtlInitializeResource+0x410 why?!
And can I somehow avoid that?

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Strange Instruction CTS BE	thomasantony	General Discussion	2	03-23-2005 04:41

All times are GMT +8. The time now is 10:43.