0

When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic process such as svchost.exe. Is there any way to capture the PID of sub-processes in windows?

0

2 Answers 2

1

If commandline is required you can subscribe to WMI Win32_ProcessStartTrace events, here's an example in PowerShell:

Register-WMIEvent -query "SELECT * FROM Win32_ProcessStartTrace" -SourceIdentifier "testevent" -action { $e = $Event.SourceEventArgs.NewEvent
Write-Host $e.ProcessName, "started" }

To stop notification call Unregister-Event Process-Started

But it might be a better solution to use Process Monitor and use the Process Tree functionality: Process Monitor | Process Tree

As an example I started a command prompt from PowerShell and then launched Notepad from that command prompt: Process Tree example

0

As mentioned by anion, you can use several graphical applications to see this information. One such application built-in to Windows is the Task Manager. Right-click on the task bar and you will see it in that menu.

If you prefer command-line, you can use tasklist (again, built-in to Windows).

If you are trying to perform malware analysis, and you are looking for an automated solution, then I suggest using a sandbox. A popular free and opensource one is Cuckoo Sandbox.

If you are analyzing the malware by hand, then you will have to look for the different ways that you mention.

CreateProcess takes a pointer to a PROCESS_INFORMATION structure as its tenth argument. After CreateProcess returns, you can look at this structure to find the PID of the child. A simpler way would be to breakpoint on CreateProcess, modify the dwCreationFlags to include SUSPENDED, step-over the CreateProcess call, then run either Task Manager or tasklist to see the child process's PID.

OpenProcess is easier. It takes the PID as the third argument. So when you see a call to OpenProcess, just look at the arguments to find the PID.

Depending on which tools you are using, you may be able to script this, such as with IDA Python, OllyScript, or x64dbg's or WinDbg's built-in scripting.

2
  • Thank you very much, but I need a command-line solution to see when the process of malware is created, what processes will be forked (injected). Could you please clarify your solution for my case? Jan 8, 2019 at 7:59
  • Does tasklist do what you want? If not, please explain further. Jan 10, 2019 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.