This question already has an answer here:
- How can DLL injection be detected? 4 answers
I'm trying to figure out how can I detect a process for being injected with a dll. I found this thread but I couldn't figure out a simple way out of it.
I want to clarify my intention: given a pid - I want to return an answer if that process was injected with a dll or not.
I thought of dumping all the dependencies of a process and then compare it to the running process - the problem is that the dependencies load their own dlls...
I heard that Anti viruses compares check sums or something like that - but couldn't understand how exactly.