Detecting Process Injection in Memory

When to Use

• You have a Windows memory image and want to find injected/hollowed code.
• You are triaging private RWX regions, unbacked executable memory, and PE headers in private allocations (classic injection/hollowing signs).

Do not use this on a live production host without authorization — work from an acquired image. This skill interprets analysis output; run Volatility separately on the image.

Prerequisites

• A memory image and Volatility 3 (windows.malfind, windows.vadinfo) installed.

Safety & Handling

• Treat carved injected regions as live malicious code; store them password-protected.

Workflow

Step 1: Run malfind and capture output

vol -f memory.raw windows.malfind > malfind.txt

Step 2: Score injection candidates

python scripts/analyst.py score malfind.txt

Flags regions with PAGE_EXECUTE_READWRITE, MZ/PE headers in private memory, and shellcode-like disassembly hints, ranking processes by suspicion.

Step 3: Corroborate

Cross-check flagged PIDs with windows.vadinfo (private, executable, no mapped file) and the process tree for anomalous parents.

Step 4: Carve and route

Carve the injected region for follow-on shellcode/PE recovery and analysis.

Validation

• Flagged regions are private + executable, not legitimate mapped images.
• PE-in-private-memory findings are confirmed by an MZ/This program signature.
• High-scoring PIDs corroborate with VAD protections and process-tree anomalies.

Pitfalls

• JIT engines (.NET, Java, browsers) legitimately create RWX regions — corroborate before alerting.
• Relying on malfind alone; pair with vadinfo and ldrmodules.
• Missing hollowing where the region is RX (not RWX) after protection change.

References

• See references/api-reference.md for the scorer.
• ATT&CK T1055 and Volatility 3 docs (linked in frontmatter).