thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Memory Injection

Inserting malicious code into the memory space of a running process to execute it under that process's context.

Definition

Memory injection hides malicious code inside legitimate processes, evading process-based detection and inheriting permissions. Techniques include DLL injection, process hollowing, reflective loading and APC injection. EDR memory scanning and behavioral monitoring detect it.

Example

A loader writing shellcode into explorer.exe with WriteProcessMemory and starting it with CreateRemoteThread.

Exam tip

Security+ lists memory injection under application attacks; EDR is the detection answer.

Related terms