Learning Malware Analysis

3. Code Injection Techniques

As mentioned earlier, the objective of a code injection technique is to inject code into the remote process memory and execute the injected code within the context of a remote process. The injected code could be a module such as an executable, DLL, or even shellcode. Code injection techniques provide many benefits for attackers; once the code is injected into the remote process, an adversary can do the following things:

• Force the remote process to execute the injected code to perform malicious actions (such as downloading additional files or stealing keystrokes).
• Inject a malicious module (such as a DLL) and redirect the API call made by the remote process to a malicious function in the injected module. The malicious ...