Behavioral Analysis: Tracking Process Injection Techniques

Process injection is a evasion technique where malware runs malicious code in the address space of a legitimate Windows process (e.g., explorer.exe or svchost.exe).

Classic API Sequence

The most classic process injection method relies on a specific sequence of Windows APIs:

1. Open Target: Obtain a handle to the target process using OpenProcess.
2. Allocate Memory: Allocate memory in the target using VirtualAllocEx.
3. Write Shellcode: Copy the malicious payload using WriteProcessMemory.
4. Execute Code: Start execution using CreateRemoteThread.

Evasion and Modern Alternatives

Advanced malware avoids these APIs due to heavy EDR monitoring, shifting toward newer methods like Process Hollowing, Thread Execution Hijacking, and API unhooking.