In the Windows operating system, processes are allowed to allocate, read, and write in another process's virtual memory, as well as create new threads, suspend threads, and change these threads' registers, including the instruction pointer (EIP/RIP). Process injection is a technique that's implemented by malware authors so that they can inject code or a whole library (DLL) inside another process's memory and execute that code (or the entry point of that DLL) inside the space of that process.
In Windows 7 and higher, it's not permitted to perform an injection into core Windows processes such as explorer.exe or into other users' processes. But it's still OK to inject code into the current user's browsers and other processes.
This technique is legitimately used by multiple endpoint security products to monitor applications and for sandboxing (as we will see in the API hooking section), but it's also misused by malware...
