Mastering Reverse Engineering

Process and thread monitoring

Monitoring the processes and threads, especially those that were created by the file we are analyzing, tells us that there are more behaviors occurring than is obvious. A process can create multiple threads, which tells us that it might be doing several behaviors at the same time. A created process tells us that a new program was just executed.

In Windows, the termination, creation, and opening of a process can be monitored by third-party tools such as Process Monitor. Though there are built-in tools, such as Task Manager, that can show information about processes, some third-party tools can give more detail about the processes and the threads tied to it.