Entry point of malicious child process

Question

OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what the child process is doing (I can attach to the child process, but I'll still miss everything between process creation and the time I debug), I need a way to start the initial executable, such that it exhibits the behaviors of the child process. I ASSume that in order to get different behavior, the child process is being started with a different entry point than the parent process. I've found the call to CreateProcessA, and I can see the options being pushed, but am not certain which, if any, of these options could be used to set a new/different entry point.

A) Am I going about this all wrong? Is there some other way that the child process is exhibiting different behaviors from the parent?

B) If I'm not going about it all wrong, can someone help me out with finding where exactly I should set the entry point to run the process as though it was launched by the parent process?

Thanks, in advance.

Edit: I know about the "debug child process" option in OllyDbg2, but for whatever reason, it isn't working. When the child process is created, it just runs on its own, with no new debug window opening.

Answer 1

I ASSume that in order to get different behavior, the child process is being started with a different entry point than the parent process.

Not necessarily. Armadillo's parent-child-debugging scheme had the child process start with the same entrypoint as the parent process.

However, these days we more commonly see "process hollowing" / "dynamic forking", where the entrypoints are indeed different. You can see Dump a child process created by malware with an ALTERNATIVE process hollowing process for details on how to find the child process's entrypoint.