allocate-memory.yml

rule:
  meta:
    name: allocate memory
    author: 0x534a@mailbox.org
    lib: true
    scope: basic block
    mbc:
      - Memory::Allocate Memory [C0007]
    examples:
      - Practical Malware Analysis Lab 03-03.exe_:0x4010EA
      # ntdll
      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA
  features:
    - or:
      - api: kernel32.VirtualAlloc
      - api: kernel32.VirtualAllocEx
      - api: kernel32.VirtualAllocExNuma
      - api: kernel32.VirtualProtect
      - api: kernel32.VirtualProtectEx
      - api: NtAllocateVirtualMemory
      - api: ZwAllocateVirtualMemory
      - api: NtMapViewOfSection
      - api: ZwMapViewOfSection