Exam SY0-701 topic 1 question 484 discussion

C. Malicious code is copied to the allocated space of an already running process. Explanation: Memory injection occurs when malicious code is directly injected into the memory space of an already running process. This type of attack bypasses the need to write malicious code to disk, making it harder to detect with traditional file-based antivirus solutions. Examples include DLL injection or process hollowing. Why not the other options? A. Two processes access the same variable, allowing one to cause a privilege escalation: This describes a race condition, not memory injection. B. A process receives an unexpected amount of data, which causes malicious code to be executed: This describes a buffer overflow, which is a precursor to injection attacks but not memory injection itself.

From ChatGPT Memory injection is a technique where malicious code is directly injected into the memory space of an already running process, allowing the attacker to execute unauthorized commands or manipulate the process. This method bypasses traditional file-based malware detection because no malicious executable is written to disk.