Learning Malware Analysis

1.1 Process Memory Components (User Space)

With an understanding of virtual memory, let us focus our attention on a part of the virtual memory called process memory. Process memory is the memory used by user applications. The following screenshot shows two processes and gives a high-level overview of the components which reside in the process memory. In the following screenshot, the kernel space is deliberately left blank for simplicity (we will fill in that blank in the next section). Keep in mind that processes share the same kernel space:

Process memory consists of the following major components:

• Process executable: This region contains ...