Process and memory hunting¶

Memory regions and protections¶

Term	Meaning	Investigative value
`MEM_IMAGE`	Mapped executable image such as EXE/DLL	Expected home for normal program code
`MEM_PRIVATE`	Privately allocated process memory	Higher interest when executable, PE/shellcode-like, or thread-backed
`MEM_MAPPED`	Mapped section/file	Significance depends on backing and behavior
`RW`	Read/write	Normal data; watch later executable transition
`RX`	Read/execute	Normal for code; higher interest if private and unbacked
`RWX`	Read/write/execute	High interest, not automatically malicious
Unbacked executable	Executable memory with no normal EXE/DLL image	High interest

Do not hunt only for RWX:

Allocate RW → Write payload → Change RW to RX → Execute

Ask whether the thread start address falls inside a legitimate loaded module.

Thread start → MEM_PRIVATE → executable → no corresponding image

APIs to recognize¶

API	Purpose
`VirtualAlloc` / `VirtualAllocEx`	Allocate memory locally / in another process
`WriteProcessMemory`	Write into another process
`VirtualProtect` / `VirtualProtectEx`	Change local / remote memory protection
`CreateThread` / `CreateRemoteThread`	Create local / remote thread
`NtAllocateVirtualMemory`	Native allocation equivalent
`NtWriteVirtualMemory`	Native cross-process write
`NtProtectVirtualMemory`	Native protection change
`NtCreateThreadEx`	Native thread creation

Classic memory aid

ALLOCATE → WRITE → EXECUTE

VirtualAllocEx → WriteProcessMemory → VirtualProtectEx → CreateRemoteThread

API use alone is not malicious.

Technique clues¶

Technique	Look for
Shellcode	Private executable memory, no normal image backing
Process injection	Cross-process access, remote allocation/write, executable protection, abnormal thread start
Process hollowing	Suspended/legitimate process with altered image; Sysmon 25 may help
Reflective DLL loading	PE-like private memory, executable regions, missing normal image-load path
Module stomping	Legitimate mapped module whose contents no longer match expected image

JIT caveat¶

Browsers, .NET, Java/JVM, JavaScript engines, and other JIT runtimes legitimately create executable private memory. Correlate memory evidence with process identity, lineage, signer, module provenance, user activity, and network behavior.