From a6cdff6eb66617c947c1778cfc0ae524ac25f0b5 Mon Sep 17 00:00:00 2001 From: mether049 Date: Tue, 7 Jan 2020 00:55:54 +0900 Subject: [PATCH] Update analysis_processhollowing.md --- Trickbot/analysis_processhollowing.md | 1 + 1 file changed, 1 insertion(+) diff --git a/Trickbot/analysis_processhollowing.md b/Trickbot/analysis_processhollowing.md index f60240a..d537c90 100644 --- a/Trickbot/analysis_processhollowing.md +++ b/Trickbot/analysis_processhollowing.md @@ -116,6 +116,7 @@ Process Hollowingにも利用するデータに関する説明 ![](https://github.com/mether049/malware/blob/master/Trickbot/img/apicall_15_720.png) - 以下は[NtQueryInformationProcess](https://docs.microsoft.com/ja-jp/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess?redirectedfrom=MSDN)の呼び出し後におけるPROCESS_BASIC_INFORMATION構造体の各メンバの値である - svchost.exeのプロセスIDは9652 + ![](https://github.com/mether049/malware/blob/master/Trickbot/img/PROCESS_BASIC_INFORMATION.png) ![](https://github.com/mether049/malware/blob/master/Trickbot/img/processhacker.PNG)