A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All this happens with calls to Winapi functions like
And even tho the malware that gets injected by the Runtime Crypter might be hardly detected by any AV (because it's writting into RAM instead of on the disc): How can it be that a modern Crypter itself is not detected by AV? I mean even if I add a lot of junk code to change the Signature, the suspicious function calls abovementioned have still to be there. Heuristic analysis should technically be able to detect such malware, shouldn't it?