weev3
6e65bbd146
* Add test for T1196 that pops calc.exe * calc.cpl * Rename T1196.md to T1196.yaml * Create calc.cpp
13 lines
254 B
C++
13 lines
254 B
C++
#include <stdio.h>
|
|
#include <Windows.h>
|
|
|
|
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID
|
|
lpReserved)
|
|
{
|
|
// malicious code
|
|
if (ul_reason_for_call == DLL_PROCESS_ATTACH)
|
|
system("c:\\windows\\system32\\calc.exe");
|
|
|
|
return 0;
|
|
}
|