# 💉 Memory Injection Techniques

Fileless malware doesn't write to disk. It lives in RAM.

## 📝 The Raw Log (Sysmon Event 8)

```json
{
  "event_id": 8,
  "desc": "CreateRemoteThread",
  "source_image": "C:\Users\Bob\AppData\Local\Temp\malware.exe",
  "target_image": "C:\Windows\System32\explorer.exe",
  "target_process_id": "4022",
  "start_address": "0xDEADBEEF"
}
```

## 🕵️‍♂️ Investigation Steps

### Step 1: The "Injector"
* **Source**: `malware.exe` running from `Temp`.
* **State**: This is the malicious dropper.

### Step 2: The "Victim"
* **Target**: `explorer.exe`. This is the Windows desktop/file manager. It is *always* running.
* **Action**: `CreateRemoteThread`. The source is forcing the target to run code.

### Step 3: The Result
* Once injected, `malware.exe` can delete itself.
* The malicious code now runs INSIDE `explorer.exe`.
* **Implication**: You will see `explorer.exe` making network connections to Russia. If you kill `explorer`, you kill the user's desktop session.

### 🛡️ Response
Do not just kill the process. Isolate the host and run memory forensics.
