Change Module Name at Runtime

Created the Monday 18 July 2022. Updated 1 year, 7 months ago.

It is possible to change the name of the current process or any of its modules at runtime. This is achieved by accessing the process PEB's member 'Ldr', in particular it has a member 'InOrderMemoryLinks' which we can iterate through to get a list of the process's modules.

On each iteration it gets a PLDR_DATA_TABLE_ENTRY structure to work with which contains a member UNICODE_STRING FullDllName, which can be overwritten with the module name.


Technique Identifier

U1238


Code Snippets


Subscribe to our Newsletter

Don't miss out on the latest and greatest updates from us! Subscribe to our newsletter and be the first to know about exciting content and future updates.