## Process Analysis & Injection Detection

Malware rarely runs as `virus.exe`. It hides inside legitimate processes. This is **Process Injection**.

### 1. DLL Injection
*   **Concept**: Force a legitimate process (e.g., Chrome) to load a malicious DLL.
*   **Mechanism**:
    1.  Malware runs.
    2.  Allocates memory in Chrome (VirtualAllocEx).
    3.  Writes path to evil DLL (WriteProcessMemory).
    4.  CreateRemoteThread starting at LoadLibrary("evil.dll").
*   **Result**: The malware code runs *inside* Chrome's memory space. Firewalls allow Chrome.

### 2. Process Hollowing (RunPE)
*   **Concept**: A zombie suit.
*   **Mechanism**:
    1.  Start a legitimate process (e.g., `svchost.exe`) in "Suspended Mode".
    2.  Unmap (Hollow out) the legitimate code from memory.
    3.  Write the malware code into that empty space.
    4.  Resume the thread.
*   **Result**: Task Manager says "svchost.exe". The Hash on disk is clean (Microsoft signed). But the memory is pure malware.
*   **Detection**: **Volatility `malfind`** spots this mismatch between the file on disk (VAD) and the content in RAM.

### 3. Reflective DLL Injection
*   Loading a DLL directly from memory without it ever touching the disk.
*   Extremely hard to detect with traditional AV.
*   Used heavily by tools like **Cobalt Strike** and **Metasploit** (Meterpreter).

### 4. Atom Bombing / Propagate
*   Using obscure Windows API mechanisms (Atom Tables, GUI Event Hooks) to trigger code execution in other processes without using the noisy "CreateRemoteThread" call.

### The Analyst's Eye
In Memory Forensics, you look for **Inconsistencies**.
*   The PEB (Process Environment Block) says the path is `C:WindowsSystem32svchost.exe`.
*   The VAD (Virtual Address Descriptor) says the memory map is Private Commit (not maximizing a file).
*   This discrepancy confirms Hollowing.