IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Advance_Forensics/notes/08-process-and-memory-basics.md

⚙️ Process & Memory Basics

What is Process Analysis?

Process analysis = Understanding what programs are running and what they're doing.

For the exam: This is Tier 2 — Important but less frequently tested than registry.

🎯 Key Process Information

What Each Process Tells Us

Process Name:      What program is running
PID (Process ID):  Unique number for this execution
Parent PID:        What program started this process?
Memory Usage:      How much RAM does it use?
Threads:           How many threads (tasks) is it running?
Loaded DLLs:       What libraries does it use?
Network Ports:     What network connections?

🔍 Tools for Process Analysis

Tool 1: Task Manager (Basic)

Windows built-in:
Ctrl+Shift+Esc

Shows:
├── Process name
├── CPU usage
└── Memory usage

Limitation: Limited info, doesn't show DLLs or parent process

Tool 2: Process Hacker (Advanced)

Free tool: processhacker.sourceforge.io

Shows:
├── Process tree (which process started which)
├── Loaded DLLs
├── Memory usage
├── Network connections
└── Handles (open files)

Best for: Detailed forensic analysis

Tool 3: ProcMon (Process Monitor)

By Sysinternals:
Real-time monitoring of:
├── File operations
├── Registry access
├── Network events
└── Process operations

Best for: Understanding what a program does

📊 Process Investigation Questions

Q: "What was running at the time of breach?"

Answer requires:

Where to find:

Q: "What is this suspicious process?"

Investigation steps:

1. Get process name
2. Check location (Program Files = normal, Temp = suspicious)
3. Check parent process (Normal: Explorer.exe, Suspicious: ??)
4. Check DLLs (Known = normal, Unknown = suspicious)
5. Check network connections
6. Check file creation time

🔗 Connecting Processes to Registry

Registry Run Keys = Process Persistence

Registry entry:
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
Value: "Antivirus" = "C:\Windows\Temp\malware.exe"

Means:
This process will run automatically on user login

Loaded DLLs in Registry

File associations registry shows:
What program opens what file type

Example:
.exe files → notepad.exe (suspicious!)
.docx files → WinWord.exe (normal)

🎯 Exam-Relevant Process Topics

Topic 1: Process Tree (Parent-Child)

Legitimate:
explorer.exe (Explorer)
└─ notepad.exe (User opened Notepad)
   └─ spellchecker.dll (Plugin)

Suspicious:
explorer.exe
└─ cmd.exe (Command prompt - why?)
   └─ powershell.exe (PowerShell - suspicious!)
      └─ malware.exe (Downloaded malware)

Topic 2: Process Injection

Legitimate:
Calculator.exe (standalone)

Suspicious:
Calculator.exe
└─ Contains loaded DLL: malicious_injected.dll

Sign: Process injected with malicious code

Topic 3: Hidden Processes

Signs:
├─ Process not visible in Task Manager
├─ Process Hacker shows it (rootkit technique)
├─ Process has no parent
└─ Process name looks like system process but isn't

Example:
svchost.exe (REAL Windows service)
vs.
svchosts.exe (FAKE - similar name, malicious)

📝 For Your Exam

Focus on Registry First

The uploaded lectures and verified 2025 exam prioritize live process, API, and
memory behavior. Registry analysis is supplemental and is especially useful
for persistence exercises.
Process analysis covers remaining 10%

Useful Process Knowledge

✅ Know how to identify suspicious process names
✅ Know parent process shouldn't be unusual
✅ Know how to connect registry Run keys to processes
✅ Know basic DLL injection concept

Not Required (Tier 3)

❌ Deep memory forensics
❌ Process hollowing details
❌ Rootkit identification techniques
❌ Hardware-level process protection

💡 Quick Checklist

Last Updated: June 15, 2026