cheatsheets/cheatsheets/security/malware/createmutex.md

---

title: createmutex.md

categories: [cheatsheets]

CreateMutex()

---

HANDLE WINAPI CreateMutex(
  _In_opt_ LPSECURITY_ATTRIBUTES lpMutexAttributes,
  _In_     BOOL                  bInitialOwner,
  _In_opt_ LPCTSTR               lpName
);

---

Microsoft Documentation: https://msdn.microsoft.com/en-us/library/windows/desktop/ms682411(v=vs.85).aspx

---

Mutexes are used for inter-process communication, eg. Malware checks if its already running by opening a preset mutex OpenMutex(), and thereby checking if its already running. Example below.

---

Usage:

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

int main() {

	LPCSTR mName = "MyMutex";

	HANDLE hMutex = CreateMutex(NULL, true, mName);

	if(!GetLastError()) {
		printf("Mutex \"%s\" created with Handle: %d
", mName, hMutex);
	}



	HANDLE oMutex = OpenMutex(MUTEX_ALL_ACCESS, false, mName);

	if(GetLastError() == ERROR_FILE_NOT_FOUND) {
		printf("Malware not running...
");
	}

}