Another simple solution is to attach to the targeted process before the malware executes CreateRemoteThread or modify the CreateRemoteThread's creation flags to CREATE_SUSPENDED, like this:
CreateRemoteThread(Process, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibrary, (LPVOID)Memory, CREATE_SUSPENDED, NULL);
To be able to do so, we need to know the targeted process that the malware will inject into. This means that we need to set breakpoints on the Process32First and Process32Next APIs and analyze the code in-between searching for the APIs, such as strcmp or equivalent code, to find the required process to inject into. Not all calls are just for process injection; for example, they can also be used as an anti-reverse engineering trick, as we will see in Chapter 5, Bypassing Anti-Reverse Engineering Techniques.
