I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , but this process hollowing doesn't call to that Api.
This is the exactly what happens:
CreateProcessA: creates a new process and the process creation flag 0x00000004 is used to create the process in the suspended state
ReadProcessMemory: reads image base of the suspended process
NtCreateSection: creates two read/write/execute sections
ZwMapViewOfSection: maps the read/write/execute sections into the malware’s address space
ZwMapViewOfSection: maps the second section into the suspended process’s address space (this section is therefore shared between both processes).
ReadProcessMemory: reads image base of the suspended process’s image into section 1
ReadProcessMemory: reads image base of the malware’s image into section 2
NtMapViewOfSection: overwrites the suspended process's entry point code by mapping section 1 to the new process base address
ResumeThread: resumes the thread of the suspended process executing the injected code
Knowing this, and due english its my not maternal language and there are too much technical words... which call of the apis above should I have a look to find the EP? Probably the last NtMapViewOfSection ?