What is DLL Injection, Direct injection, Hook injection, Virtual address injection

DLL injection involves injecting a DLL (Dynamic Link Library) into the address space of a running process.

The injected DLL can then be loaded and executed by the target process, effectively introducing malicious code without directly modifying the target process's code itself.

This makes DLL injection a popular technique for malware authors as it can be more stealthy and evade some detection mechanisms.

Direct injection: This technique involves injecting machine code directly into the address space of a target process. While possible, it's more complex to implement and leaves a more noticeable footprint compared to DLL injection.

Hook injection: In this technique, the malware hooks a system API function and replaces its behavior with its own code. While DLL injection can be used in conjunction with hooking, hooking itself isn't the primary method for concealed DLL loading.

Virtual address injection: This technique involves allocating memory within the target process's address space and injecting code or data there. It's less common than DLL injection for concealed loading scenarios.