312-49 · Question #558
Which of the following data structures stores attributes of a process, as well as pointers to other attributes and data structures?
The correct answer is D. EProcess. EPROCESS (Executive Process) is a Windows kernel data structure (opaque structure maintained by the Windows Executive) that represents a process. It stores core process attributes such as the process ID, image name, memory details, security token, handle table, and pointers to re
Question
Which of the following data structures stores attributes of a process, as well as pointers to other attributes and data structures?
Options
- ALsproc
- BDumpChk
- CRegEdit
- DEProcess
How the community answered
(25 responses)- A4% (1)
- C8% (2)
- D88% (22)
Explanation
EPROCESS (Executive Process) is a Windows kernel data structure (opaque structure maintained by the Windows Executive) that represents a process. It stores core process attributes such as the process ID, image name, memory details, security token, handle table, and pointers to related structures like thread lists (ETHREAD) and the Process Environment Block (PEB). Forensic memory analysis tools parse EPROCESS blocks to enumerate running processes, including hidden ones.
Topics
Community Discussion
No community discussion yet for this question.