Well the problem with this approach is that the injection happens
using the WinAPI which is also used by native windows applications.
A very common chain that has been out there in the wild for a while now
is the following one:
OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread
and variants. If you notice all of the above functions are part of the WinAPI.
Now let's study what exactly each of these functions do. From the MSDN docs:
OpenProcess: Opens an existing local process object. The access to the process object. This access right is checked against the security descriptor for the process.
So this is a simple function that justs allows an application to get a handle and interact
with another process if it has the appropriate rights. This is very common to happen on windows
for various applications.
VirtualAllocEx: Reserves, commits, or changes the state of a region of memory within the virtual address space of a specified process. The function initializes the memory it allocates to zero.
So again this function can be used to allocate some memory space which is useful
if e.g. someone wants to make a custom memory manager for an application. Even malloc
which is used a lot in C/C++ programming in its core uses VirtualAllocEx
and variants.
WriteProcessMemory: Writes data to an area of memory in a specified process. The entire area to be written to must be accessible or the operation fails.
Well, what is the point of allocating space if you can't write to it (if you have the
appropriate privileges/rights of course).
CreateRemoteThread: Creates a thread that runs in the virtual address space of another process.
Creating threads is useful for many reasons. In this case - it is just a way we can execute the process we already have a handle for, using OpenProcess
from above.
In addition a variant of the above routine is also used for DLL injection/hooking which is used e.g. by software debuggers.
So as you can see this technique is often used to inject malicious code but it is also used by built-in applications. For this reason there are other techniques (e.g. code signature etc...) to prevent malware infection/injection. The bad news is that unfortunately there are also ways to bypass some of these techniques.