Memory Injections - CompTIA Security+ SY0-701 - 2.3

Understanding Malware Execution in Memory

How Software Operates in Memory

• All software on a computer operates within memory, requiring loading from disk to execute via the CPU.

• Malware must also enter memory to function, utilizing various processes like DLLs (Dynamic-Link Libraries), threads, and buffers.

Methods of Malware Execution

• Malware can either run as an independent process or inject itself into an existing process in memory.

• Injection allows malware to evade detection by anti-malware tools and gain the same permissions as the host process, potentially leading to privilege escalation.

Common Techniques: DLL Injection

• One prevalent method of malware injection is DLL injection, where malicious DLL files are used to exploit legitimate processes.