Fig 3 - uploaded by Mohamed Alshehri
Content may be subject to copyright.
Download
View publication
CreateRemoteThread() Injection

CreateRemoteThread() Injection

Source publication
Fig. 1. Process Injection Steps
Fig. 2. Minjector Injection Steps
Fig. 3. CreateRemoteThread() Injection
Fig. 4. Stealth Injection
+4 Fig. 5. Image Mapping Injection
Windows Memory-Injected Malware Detection Freeware Comparison
Article
Full-text available
  • May 2021
This paper compares different open-source tools available to determine which one is the most efficient in different business situations in terms of comprehensive detection, steps for configuration, and utilities for relaying discoveries. These tools include Memhunter, Volatility, and Sysmon.
Cite
Download full-text

Context in source publication

Context 1
... Using LoadLibraryW, use CreateRemoteThread() to make a thread that runs the created address space for the DLL above. (The header from LoadLibraryW can be seen in Figure 3.) 6) Close the process handle from step 1. The major difference between the normal and this "stealthy" CreateRemoteThread() injection is the PE header is deleted when the DLL is loaded directly. ...