Memory Injections 2.3

Question 1

Finding Malware

Answer 1

Malware runs in memory. Memory forensics can find the malicious code.

Memory contains running processes. DLLs (Dynamic Link Libraries), Threads, Buffers, Memory management functions, and more.

Malware is hidden somewhere; Malware runs in its own process. Malware injects itself into a legitimate process.

Question 2

memory Injection

Answer 2

Add code into memory of an existing process. Hide Malware inside of the process.

Get access to the data in that process. And the same rights and permissions. Perform a privilege escalation.

Question 3

DLL injection

Answer 3

Dynamic- Link Library.
A windows Library containing code and data. Many applications can use this library.

Attacks inject a path to run a malicious DLL. Runs as part of the target process.

One of the most popular memory injection methods. Relatively Easy to implement.