Malware Analysis - Code Injection via CreateRemoteThread & WriteProcessMemory

[baziroll]

Published on May 3, 2017
We take a look into the malware Gatak which uses WriteProcessMemory and CreateRemoteThread to inject code into rundll32.exe.
Many thanks to @_jsoo_ for providing the sample!

Follow me on Twitter: https://twitter.com/struppigel

Gatak VirusBtn article: https://www.virusbulletin.com/virusbu...
Sample: https://www.hybrid-analysis.com/sampl...
API Monitor: http://www.rohitab.com/apimonitor
Process Explorer: https://technet.microsoft.com/en-us/s...
x64dbg: http://x64dbg.com/
HxD: https://mh-nexus.de/en/hxd/

• Category
  • Science & Technology
    
• License
  • Standard YouTube License