fix example function address

mandiant · Aug 19, 2023 · 64d3a35 · 64d3a35
1 parent 7685a23
commit 64d3a35
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/host-interaction/process/inject/free-user-process-memory.yml b/host-interaction/process/inject/free-user-process-memory.yml
@@ -10,7 +10,7 @@ rule:
     mbc:
       - Memory::Free Memory [C0044]
     examples:
-      - 493167E85E45363D09495D0841C30648:0x404B00
+      - 493167E85E45363D09495D0841C30648:0x404CA0
   features:
     - and:
       - match: attach user process memory