NtResumeThread

Prototype

NTSTATUS NtResumeThread(
  HANDLE ThreadHandle,
  PULONG PreviousSuspendCount
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 52 00 00 00      mov eax, 0x52
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Simple wrapper over `KeResumeThread` — it decrements `KTHREAD.SuspendCount` and, if the count reaches zero, removes the suspend APC and lets the scheduler pick the thread. SSN `0x52` has been stable across all shipped Win10/11 builds. Note that a thread can be suspended more than once: each `NtSuspendThread` increments the counter and each `NtResumeThread` must decrement it to actually resume. The Win32 `ResumeThread` returns `(DWORD)-1` on failure and the previous count on success, mapping directly onto `PreviousSuspendCount`.

Common malware usage

Almost never abused on its own — but it is the *trigger* of every injection technique that uses `CREATE_SUSPENDED`. Process Hollowing (RunPE), Process Doppelgänging, Transacted Hollowing, EarlyBird APC injection, Thread Hijacking, and Thread Stack Spoofing all end with an `NtResumeThread` call that fires the planted payload. Defenders therefore treat the *sequence* `CreateProcess(SUSPENDED)` → unmap/write/queue-APC/set-context → `NtResumeThread` as the canonical pattern, not the resume in isolation.

Detection opportunities

There is no Sysmon event for `NtResumeThread` itself, and the syscall is far too common (every `CREATE_SUSPENDED` legitimately ends with one) to alert on directly. Detection lives in correlation: when an EDR observes `NtWriteVirtualMemory` or `NtSetContextThread` against a thread followed by `NtResumeThread` from a remote process, it raises a high-confidence injection alert. ETW Threat Intelligence emits a signal on `EtwTiLogSetContextThread` when context is patched on a remote thread — that is the typical pivot point captured before the resume. Stack-walk callbacks on the first user-mode instruction after resume can reveal a `StartAddress` that lives in private RWX memory.

Direct syscall examples

; Direct syscall stub for NtResumeThread (SSN 0x52, stable across all Win10/11)
NtResumeThread PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 52h          ; SSN
    syscall
    ret
NtResumeThread ENDP

// After unmapping the original image and writing the payload, resume the suspended
// primary thread to detonate the planted PE.
ULONG prev = 0;
NTSTATUS st = NtResumeThread(pi.hThread, &prev);
if (!NT_SUCCESS(st)) {
    // Resume failed — clean up the hollowed process before EDR notices.
    TerminateProcess(pi.hProcess, 0);
    return st;
}

use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_resume_thread_stub() {
    // SSN 0x52 across every supported build.
    asm!(
        "mov r10, rcx",
        "mov eax, 0x52",
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1055Process Injection
• T1055.012Process Hollowing
• T1055.004Asynchronous Procedure Call
• T1106Native API