A system, comprising: a processor configured to: in response to a completion of launch of a process and prior to an execution of the process, determine a first base address associated with the process, wherein the first base address associated with the process is associated with a first memory block from which instructions associated with the process are to be read and executed; determine whether the first memory block associated with the first base address is associated with a write permission; and in response to a determination that the first memory block associated with the first base address associated with the process is associated with the write permission: determine whether a portable executable header code included in a memory image associated with the process matches a designated code associated with an ordinary process; and in response to a determination that the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process: determine that the process is a potential malware process; and prevent the execution of the process; and a memory coupled to the processor and configured to provide the processor with instructions. a processor configured to: in response to a completion of launch of a process and prior to an execution of the process, determine a first base address associated with the process, wherein the first base address associated with the process is associated with a first memory block from which instructions associated with the process are to be read and executed; determine whether the first memory block associated with the first base address is associated with a write permission; and in response to a determination that the first memory block associated with the first base address associated with the process is associated with the write permission: determine whether a portable executable header code included in a memory image associated with the process matches a designated code associated with an ordinary process; and in response to a determination that the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process: determine that the process is a potential malware process; and prevent the execution of the process; and in response to a completion of launch of a process and prior to an execution of the process, determine a first base address associated with the process, wherein the first base address associated with the process is associated with a first memory block from which instructions associated with the process are to be read and executed; determine whether the first memory block associated with the first base address is associated with a write permission; and in response to a determination that the first memory block associated with the first base address associated with the process is associated with the write permission: determine whether a portable executable header code included in a memory image associated with the process matches a designated code associated with an ordinary process; and in response to a determination that the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process: determine that the process is a potential malware process; and prevent the execution of the process; and determine whether a portable executable header code included in a memory image associated with the process matches a designated code associated with an ordinary process; and in response to a determination that the PE header code included in the memory image associated with the process matches the designated code associated with the ordinary process: determine that the process is a potential malware process; and prevent the execution of the process; and determine that the process is a potential malware process; and prevent the execution of the process; and a memory coupled to the processor and configured to provide the processor with instructions.