Courseiva
Malware, Social Engineering and Network AttacksmediumMultiple ChoiceObjective-mapped

CEH Practice Question: Malware, Social Engineering and Network Attacks

After a security incident, an analyst retrieves a suspicious file. The analyst runs the 'strings' command on it and sees references to 'CreateRemoteThread' and 'WriteProcessMemory'. Which technique does this indicate?

⚠ Common exam trap

The EC-CEH exam often tests the distinction between process injection and DLL hijacking. Candidates mistakenly associate any DLL-related API call with DLL hijacking, but the key differentiator is that process injection explicitly uses WriteProcessMemory and CreateRemoteThread to write and execute code in a remote process, whereas DLL hijacking relies on search order manipulation without direct memory writing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Process injection

The presence of 'CreateRemoteThread' and 'WriteProcessMemory' in the output of the 'strings' command is a strong indicator of process injection. These Windows API functions are commonly used together to allocate memory in a target process (VirtualAllocEx), write malicious code into that memory (WriteProcessMemory), and then execute it in the context of the remote process (CreateRemoteThread). This technique allows an attacker to run arbitrary code within a legitimate process, bypassing security controls.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • DLL hijacking

    Why it's wrong here

    DLL hijacking exploits the Windows loader's search order or missing DLLs to load a malicious library instead of a legitimate one. This technique relies on manipulating file paths or environment variables to trick an application into loading the attacker's code, rather than directly using `WriteProcessMemory` to insert arbitrary bytes and `CreateRemoteThread` to execute them within an existing process's memory space. It's about library loading, not direct memory injection via these specific APIs.

  • Privilege escalation

    Why it's wrong here

    Privilege escalation refers to the act of gaining higher access rights than initially possessed, often by exploiting system vulnerabilities, misconfigurations, or weak permissions. While process injection can be a *means* to achieve privilege escalation if the target process has elevated privileges, it is not the *mechanism* of escalation itself. The API calls `CreateRemoteThread` and `WriteProcessMemory` facilitate code execution within a process, but they do not inherently change the security context or privileges of the executing user or process.

  • Process injection

    Why this is correct

    Process injection is a sophisticated technique where an attacker writes malicious code into the address space of a legitimate, running process and then forces that process to execute it. The `WriteProcessMemory` API is crucial for writing the attacker's shellcode or payload into the target process's memory. Subsequently, `CreateRemoteThread` is commonly used to create a new thread within the remote process, directing its execution flow to the starting address of the newly injected code, thereby achieving execution within the target's context.

  • Buffer overflow

    Why it's wrong here

    A buffer overflow is a memory corruption vulnerability that occurs when a program attempts to write data beyond the allocated boundaries of a fixed-size buffer, overwriting adjacent memory. Exploiting this vulnerability can lead to arbitrary code execution by manipulating program control flow, typically by overwriting return addresses or function pointers. However, this is a vulnerability exploitation method that relies on malformed input, distinct from the direct and intentional use of `WriteProcessMemory` and `CreateRemoteThread` to inject and execute code in a remote process's memory space.

About these practice questions

This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.