Memory Injections - CompTIA Security+ SY0-701 - 2.3
Understanding Malware Execution in Memory
How Software Operates in Memory
- All software on a computer operates within memory, requiring loading from disk to execute via the CPU.
- Malware must also enter memory to function, utilizing various processes like DLLs (Dynamic-Link Libraries), threads, and buffers.
Methods of Malware Execution
- Malware can either run as an independent process or inject itself into an existing process in memory.
- Injection allows malware to evade detection by anti-malware tools and gain the same permissions as the host process, potentially leading to privilege escalation.
Common Techniques: DLL Injection
- One prevalent method of malware injection is DLL injection, where malicious DLL files are used to exploit legitimate processes.