windows - Hiding the process name to avoid DLL injection. How feasible is it? -

the idea quite simple, i.e try not follow standard. example inject thing firefox, malware need know name of process 'firefox.exe' or inject thing in internet explorer, malware need know process 'iexplorer.exe'. if firefox or internet explorer not follow convention hard. idea put logic change name of process. real 'firefox.exe' replaced our 'firefox.exe' file. duplicate file startup , real firefox executable renamed `random string.exe'. when system triggers 'firefox.exe', open our 'firefox.exe' executable. executable in-turn open real firefox exectable 'random string.exe' , set dummy process information using 'setprocessinformation' api. using 'setprocessinformation' set false location of executable malware not able find real process based on location.

can body suggest how feasible (provided setprocessinformation can set false process location)?

its not worth trouble.

an attacker needs handle process, , if rename exe make tiny bit more difficult, not much. example monitoring processes open firefox history database or process dns lookup firefox update server enough that. or md5 summing exes , having set of known binary images.

basically if have code can inject dlls or code foreign processes have lost control of system.