A method, comprising: determining that a process loader (406; 606; 806) of an operating system (404; 604; 804) has initiated the creation of a computing process (410; 610; 810); in response to determining that the process loader has initiated the creation of the computing process, injecting code in the computing process that is configured to modify the computing process by: determining that at least one library module (422; 622; 822) of the computing process is to be loaded into memory; storing the at least one library module at a first address in the memory; copying the at least one library module stored at the first address to a second address (424; 624; 824) in the memory that is different than the first address; and modifying the at least one library module stored at the first address into a stub library module (422'; 622; 822); and causing a first procedure call for a procedure in the at least one library module to reference the second address of the at least one library module, the first procedure call being included in at least one of a binary image from which the computing process is created and one or more other library modules imported for the computing process; and causing a second procedure call for a procedure in the at least one library module to reference the first address of the at least one library module, the second procedure call originating from malicious code (638; 838) that is injected into the computing process after loading of the binary image into memory is complete. determining that a process loader (406; 606; 806) of an operating system (404; 604; 804) has initiated the creation of a computing process (410; 610; 810); in response to determining that the process loader has initiated the creation of the computing process, injecting code in the computing process that is configured to modify the computing process by: determining that at least one library module (422; 622; 822) of the computing process is to be loaded into memory; storing the at least one library module at a first address in the memory; copying the at least one library module stored at the first address to a second address (424; 624; 824) in the memory that is different than the first address; and modifying the at least one library module stored at the first address into a stub library module (422'; 622; 822); and determining that at least one library module (422; 622; 822) of the computing process is to be loaded into memory; storing the at least one library module at a first address in the memory; copying the at least one library module stored at the first address to a second address (424; 624; 824) in the memory that is different than the first address; and modifying the at least one library module stored at the first address into a stub library module (422'; 622; 822); and causing a first procedure call for a procedure in the at least one library module to reference the second address of the at least one library module, the first procedure call being included in at least one of a binary image from which the computing process is created and one or more other library modules imported for the computing process; and causing a second procedure call for a procedure in the at least one library module to reference the first address of the at least one library module, the second procedure call originating from malicious code (638; 838) that is injected into the computing process after loading of the binary image into memory is complete.