Function: 0x45B8DB
What it does: The function calls GetProcAddress for DeleteProcThreadAttributeList and CreateProcess.
Why it matched: capa matched the regex del on the API string DeleteProcThread.... The function creates a process with a specified parent (PID Spoofing), it does not delete itself.
Function:
0x45B8DBWhat it does: The function calls
GetProcAddressforDeleteProcThreadAttributeListandCreateProcess.Why it matched: capa matched the regex
delon the API stringDeleteProcThread.... The function creates a process with a specified parent (PID Spoofing), it does not delete itself.