Skip to content

Latest commit

 

History

History
49 lines (43 loc) · 1.18 KB

terminate-thread.md

File metadata and controls

49 lines (43 loc) · 1.18 KB
ID C0039
Objective(s) Process
Related ATT&CK Techniques None
Version 2.1
Created 4 December 2020
Last Modified 30 April 2024

Terminate Thread

Malware terminates a thread.

Detection

Tool: capa Mapping APIs
terminate thread Terminate Thread (C0039) kernel32.TerminateThread, PsTerminateSystemThread, System.Threading.Thread.Abort

C0039 Snippet

Process::Terminate Thread SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f Location: 0x14000395B 
mov     param_1, qword ptr [DAT_14000ca58]      ; thread to terminate
xor     param_2, param_2        ; set the thread's exit status to 0
call    qword ptr [->KERNEL32.DLL::TerminateThread]     ; call the Windows API function to terminate the thread