Learning Malware Analysis

4.1 Process Overview

A process is an object. The Windows operating system is object-based (not to be confused with the term object used in object-oriented languages). An object refers to a system resource such as a process, file, device, directory, mutant, and so on, and they are managed by a component of a kernel called object manager. To get an idea of all the object types on Windows, you can use the WinObj tool (https://docs.microsoft.com/en-us/sysinternals/downloads/winobj). To look at the object types in WinObj, launch WinObj as an Administrator and, in the left-hand pane, click on ObjectTypes, which will display all the Windows objects.

The objects (such as processes, files, threads, and so on) are represented as structures in C. What ...