Patent ID: 8065734
Filing Date: 2011-11-22
Classification: G06F

Abstract:
1. A computer-implemented method comprising: determining that a Dynamic Link Library (DLL) is being loaded into a non-suspicious module of a process; allowing said DLL to be loaded into said non-suspicious module without interception; determining that said DLL is being loaded into a suspicious module of said process; creating an intercept function for a tracked Dynamic Link Library (DLL) function of said DLL being loaded into said suspicious module, replacing an import address table entry for said tracked DLL function with an address of said intercept function; entering said intercept function comprising causing a call from said suspicious module to said tracked DLL function to be intercepted by said intercept function; associating said suspicious module with a thread presently executing; and passing said call to said tracked DLL function comprising causing said tracked DLL function to be executed, wherein actions caused by said execution are attributed to said suspicious module allowing a behavior blocking application to make decisions with regards to said suspicious module causing said actions instead of said process.