Patent ID: 8959639
Filing Date: 2015-02-17
Classification: G06F

Abstract:
1. A method of detecting and blocking malicious activity of processes in computer memory during unpacking of a file after the code and data contained in the file are unpacked, including the steps of: (a) inserting a hook function into a process running in the computer memory, the hook function placing a hook on a system call carried out by the process; (b) receiving a first inter-process communication (IPC) constructed by the hook function, the first IPC comprising a process ID, the process ID identifying the process and the system call carried out by the process, wherein the hook function is configured to suspend the system call carried out by the process upon constructing the first IPC; (c) using the process ID to query a cache of scanned processes to determine whether the process has been scanned within a predetermined time period; (d) upon determining the process has not been scanned within the predetermined time period, initializing a scan of the process that carried out the system calls to determine the likelihood of the process being malicious; (e) upon determining the process has been scanned within the predetermined time period, sending a second IPC to the hook function, the second IPC comprising an instruction to the hook function to allow the system call carried out by the process to resume.