Which condition MOST strongly confirms reflective DLL loading?

The correct answer is A. DLL mapped into memory without writing to disk. Reflective DLL loading is defined by its core technique: a DLL is injected and executed entirely in memory, bypassing the Windows loader and leaving no trace on disk - making option A the strongest indicator. Options B (registry entries) and C (driver installation) are system…

Malware Obfuscation & Anti-Analysis Techniques

Question

Options

ADLL mapped into memory without writing to disk
BNew registry entries
CDriver installation
DProcess token change

How the community answered

(52 responses)

A
73% (38)
B
4% (2)
C
8% (4)
D
15% (8)

Explanation

Reflective DLL loading is defined by its core technique: a DLL is injected and executed entirely in memory, bypassing the Windows loader and leaving no trace on disk - making option A the strongest indicator. Options B (registry entries) and C (driver installation) are system persistence mechanisms that point to different attack categories entirely and leave highly visible artifacts. Option D (process token change) indicates privilege escalation techniques like token impersonation, not DLL injection.

Memory tip: Think "reflective = reflection in a mirror = exists only in memory, not on disk." If it touched disk, it would be a standard DLL load, not a reflective one.

Topics

#Reflective DLL Loading#In-Memory Loading#Anti-Analysis Techniques#Code Injection

Community Discussion

No community discussion yet for this question.

Full GREM Practice