CEH Practice Question: Malware, Social Engineering and Network Attacks
After a security incident, an analyst retrieves a suspicious file. The analyst runs the 'strings' command on it and sees references to 'CreateRemoteThread' and 'WriteProcessMemory'. Which technique does this indicate?
⚠ Common exam trap
The EC-CEH exam often tests the distinction between process injection and DLL hijacking. Candidates mistakenly associate any DLL-related API call with DLL hijacking, but the key differentiator is that process injection explicitly uses WriteProcessMemory and CreateRemoteThread to write and execute code in a remote process, whereas DLL hijacking relies on search order manipulation without direct memory writing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Process injection
The presence of 'CreateRemoteThread' and 'WriteProcessMemory' in the output of the 'strings' command is a strong indicator of process injection. These Windows API functions are commonly used together to allocate memory in a target process (VirtualAllocEx), write malicious code into that memory (WriteProcessMemory), and then execute it in the context of the remote process (CreateRemoteThread). This technique allows an attacker to run arbitrary code within a legitimate process, bypassing security controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DLL hijacking
Why it's wrong here
DLL hijacking exploits the Windows loader's search order or missing DLLs to load a malicious library instead of a legitimate one. This technique relies on manipulating file paths or environment variables to trick an application into loading the attacker's code, rather than directly using `WriteProcessMemory` to insert arbitrary bytes and `CreateRemoteThread` to execute them within an existing process's memory space. It's about library loading, not direct memory injection via these specific APIs.
- ✗
Privilege escalation
Why it's wrong here
Privilege escalation refers to the act of gaining higher access rights than initially possessed, often by exploiting system vulnerabilities, misconfigurations, or weak permissions. While process injection can be a *means* to achieve privilege escalation if the target process has elevated privileges, it is not the *mechanism* of escalation itself. The API calls `CreateRemoteThread` and `WriteProcessMemory` facilitate code execution within a process, but they do not inherently change the security context or privileges of the executing user or process.
- ✓
Process injection
Why this is correct
Process injection is a sophisticated technique where an attacker writes malicious code into the address space of a legitimate, running process and then forces that process to execute it. The `WriteProcessMemory` API is crucial for writing the attacker's shellcode or payload into the target process's memory. Subsequently, `CreateRemoteThread` is commonly used to create a new thread within the remote process, directing its execution flow to the starting address of the newly injected code, thereby achieving execution within the target's context.
- ✗
Buffer overflow
Why it's wrong here
A buffer overflow is a memory corruption vulnerability that occurs when a program attempts to write data beyond the allocated boundaries of a fixed-size buffer, overwriting adjacent memory. Exploiting this vulnerability can lead to arbitrary code execution by manipulating program control flow, typically by overwriting return addresses or function pointers. However, this is a vulnerability exploitation method that relies on malformed input, distinct from the direct and intentional use of `WriteProcessMemory` and `CreateRemoteThread` to inject and execute code in a remote process's memory space.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.