Courseiva
← CHFI
Full test
Malware Forensics →mediumMultiple ChoiceObjective-mapped

CHFI Malware Forensics Practice Question

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

⚠ Common exam trap

The CHFI exam often tests the distinction between generic code injection and its specific subtypes (like DLL injection or process hollowing), trapping candidates who choose a narrower term when the question uses the broad phrase 'injecting code' without specifying the delivery mechanism.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Code injection

Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    API hooking

    Why it's wrong here

    API hooking is a method of redirecting or monitoring the calls that an application makes to Windows API functions, typically by patching the Import Address Table or overwriting function prologues with jump instructions. However, this technique primarily intercepts execution flow and alters the behavior of existing code; it does not inherently involve writing new executable code into a running process's address space. While API hooking can be used to facilitate injection, the defining characteristic is interception, not code insertion.

  • ✗

    Process hollowing

    Why it's wrong here

    Process hollowing is a form of process replacement where a legitimate process is created in a suspended state, its original executable image is unmapped, and then malicious code is written into the now-empty address space before the process resumes. The malicious payload is placed into a fresh process that never runs its original code, rather than being inserted into an already-running process. This distinguishes it from code injection, which targets a live, executing process.

  • ✓

    Code injection

    Why this is correct

    Code injection is the correct classification because the finding that code was inserted into a running process directly matches this term. It encompasses any technique that places executable code into the virtual address space of another process and then causes it to run, often by creating a remote thread or using an asynchronous procedure call. The stem's description is a general definition of code injection, not limited to a specific delivery vector.

  • ✗

    DLL injection

    Why it's wrong here

    DLL injection is a specialized subset of code injection that involves loading a dynamic-link library (DLL) into a target process's memory, typically by calling CreateRemoteThread and LoadLibrary. However, the unknown intrusion description does not indicate that the inserted code is a DLL, as it could be raw position-independent code, an executable image, or other binary data. Therefore, this option is too specific to be the correct answer without additional detail.

About these practice questions

One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.