Hello and welcome to a new section in this section, we are going to study what your memory and the
portable executable, also known as P File.
We are going to look at in one process creation, then you move on to we do with your memory and number
three, portable executable, be far to go ahead and download this sample for which are available from
the resource section for this video.
Inside it, you will find three sample files, sample for one, for two and 40.
So now we are going to study process creation.
We are going to look at how a program is turned into a process by operating system.
So as an example, we are going to look at a C program.
So let's consider this simple C program.
This program brings Hello World and then goes into an infinite loop.
And this is sample form and C.
The samples are given to you without the file extension in order to protect you from accidentally executing
it.
So if you wanted to execute it, you would have to rename it.
And give it.
To dot ETECSA extension.
So now we see Prince Helliwell, so this is the executable file that was compiled from the source code,
so the program is secure, saying Prince, the message handler will stop today because it is inside
the infinite.
While now we are going to examine this using a tool called Process Hacker.
Open the flag folder and go down to the utilities folder, look for process Hekker.
Anthony.
Process hacker is used to study processes which are loaded and running in memory.
So this is what you will see when you first launch process occur.
In the first column, you get the name of all the processes which are currently running in memory.
If you scroll down, you can see sample four, dash one.
Heikki.
Which is this process which is running each process as a name, which is the name of the program from
which he was created, the person's name, however, is not a unique in the list of processes.
Two or more processes can have the same name without conflict.
Similarly, multiple processes from the same program file can be created.
Meaning multiple processes, meaning not only have the same name, but the same program, executable
parv.
Therefore, to uniquely identify a process, each process is given a unique I.D. call the process idea
or being he shot.
The second column shows you how unique it is for all the processes which are running.
And you can see a sample for this one has the one zero one two and there are no other bids for this
number.
So this makes this process very unique.
However, if you were to run the program again, you would have a different bidi.
And this is randomly assigned to every process.
It changes each time the program is executed, even on the very same system that's over most of it,
and you can see the corresponding executable name Bob Viddy and other information.
To investigate the process in more detail, you can double click it, you will open a new properties
window.
And there are several steps in this window.
He had the general types, which is the main one.
He also had a trench.
He had them all use the memory and so on.
As can be seen here, the image filename is also showing, including its full path.
You can also see come on line.
Over here, the directory venema started and so on.
And he's also the parent of Dispossesses Explorer.
And this is confirmed in The View here, the explorer is the parent of this process.
Now, this is because we started this process using the Ford Explorer, this window here is known as
the Explorer, and if you learned anything from here, it means that this is a child of this explorer.
Other things to keep an eye on the command line barometer's.
Over here, the command option shows the command line parameters provided to the process while analyzing
malware samples.
It is important to keep an eye on you come line field, since some malware accepts the command line
to operate and to exhibit malicious behavior without specific command line options.
Now, they may not function as intended.
So this me trick analysts and a V detection, so these are how you can use process hacker to analyze
running processes, an important concept to remember is that before a process is executed and loaded
into memory, it is a file in the hard disk file needs to be loaded by the operating system into memory
and execute it.
Then it becomes a process.
Before that it is just a file.
So that's all for this video.
I will see you in the next person.
Thank you for watching.