> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/processes.md).

# Processes

A program is a set of instructions that have been compiled into a PE file, typically a .exe or .dll. A pocess can be thought of as a container to hold the resources of a running program. multiple instances of the same program can be run, but they will do so in separate processes, and therefore have their own set of resources that are (mostly) isolated from each other.\
\
There are multiple APIs that can be used to start a process depending on your requirements. The simplest is on [CreateProcessW ](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw)which creates a process that will have the same access token as the caller; [CreateProcessAsUserW](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasuserw) can create a process using an alternate access token; and [Create ProcessWithLogonW](https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithlogonw) can create a process using a user's plaintext credentials. Ultimately, each API calls into the NtCreateUserProcess kernel function.

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/0503c20bf907334087e1cb12935254cb.png" alt=""><figcaption></figcaption></figure>