What a Process Is Made Of

Inside a Process

A process is a running program's container. When Notepad starts, Windows reads notepad.exe from disk and builds a process around it. The process holds workers to run its code, shared code it borrows, space for its data, tickets to what it opens and a badge saying who it works for. The Basics below sets these parts side by side, and each has its own page in this section. An investigator reads them because code hiding in a process shows in one of its parts, even when its name in the list looks right.

The Basics

A process holds six parts, set side by side below with Notepad as the example. Each tile says what the part is, why Windows needs it and where to read more.

The cards under the picture explain the other words these pages use, such as PID, session and kernel.

One process and its parts, with Notepad as the example (example values)

notepad.exePID 4312Parent explorer.exeSession 1Runs as alice

  • DLLs

    The shared code it borrows from Windows.

    Every program opens files and draws windows, so Windows ships that code once for all of them.

    In Notepadkernel32.dll for files, user32.dll for its window

    Loaded DLLs

  • Handles

    Its numbered tickets to things Windows owns.

    A program cannot touch a file or another process directly, so Windows hands it a ticket.

    In NotepadTicket 0x1A4 for notes.txt

    Handles, Pipes and Mutexes

  • Memory Regions

    The space where its code and data sit.

    Each program gets a space of its own, so one cannot overwrite another by mistake.

    In NotepadThe text alice types sits in its heap

    Memory Regions

  • Threads

    The workers that run its code.

    A program has several jobs at once, such as drawing its window while it saves.

    In NotepadOne thread answers alice's typing

    Threads

  • Token

    The ID badge that says who it works for.

    Windows reads the badge before every file, key or process the program opens.

    In Notepadalice, at medium integrity

    Token and Privileges

  • Command Line

    What it was told to do when it started.

    One program can do many jobs, so it is told which one.

    In Notepadnotepad.exe C:\Users\alice\notes.txt

    Command Line and Environment

Its network connections sit outside it, in Windows' network stack, which notes the process that owns each one.Network Connections

Other words to know before reading a process

  • PID and Parent PID

    What It Is
    The process ID (PID) is the number Windows gives each running process. The parent PID is the number of the process that started it.
    Why an Investigator Cares
    The parent says how a process came to run. Once a process exits, Windows is free to give its number to a new one. So read the parent from the record written when the process started, such as event 4688 in the Security log.

  • Session

    What It Is
    A session holds one person's sign-in, with its own desktop. Windows keeps its services in session 0 and runs the programs people use in their own sessions.
    Why an Investigator Cares
    A program a person opened that sits in session 0, where only Windows and its services run, is out of place.

  • Service

    What It Is
    A program the Service Control Manager, services.exe, starts and runs in the background, often at boot, under the account set for it.
    Why an Investigator Cares
    Services start with no one signed in and often run as SYSTEM, so a new one deserves a close look. Event 7045 in the System log records each service installed.
    Read More
    services.exe

  • Kernel

    What It Is
    The protected core of Windows. Ordinary programs cannot write to its memory, and it keeps the main record of every process.
    Why an Investigator Cares
    Its record of a process is hard to fake, so when it disagrees with the process's own copy, believe the kernel.

  • Integrity

    What It Is
    A level in the token, low, medium, high or system, that limits what a process may change. Standard users get medium, elevated users high and system services system.
    Why an Investigator Cares
    A program a person runs at system integrity, or at high integrity with no elevation they approved, needs a reason.

What It Is

Windows keeps two records of every process. One sits in the kernel, the protected core of Windows, and the other, the process environment block (PEB), sits in the process's own memory.

Why Windows Needs It
Windows needs a record it can trust, so it keeps one in memory that ordinary programs cannot reach. A program also needs its own details at hand, such as its command line and loaded DLLs. So Windows puts a copy of those in the program's own memory.
An Everyday Example
Notepad's PID, parent and token sit in the kernel's record. Its command line, notepad.exe C:\Users\alice\notes.txt, sits in its PEB, where Notepad's own code can read it and could change it.
The two records Windows keeps of every process

The Kernel's Record

Ordinary programs cannot change it

  • PID and parent PID
  • The program file it started from
  • Its threads
  • Its handles
  • Its memory map
  • Its token

The Process's Own Copy (PEB)

Code running in the process can rewrite it

  • Its command line
  • A copy of the program's path
  • The lists of DLLs it loaded
Kept by the Kernel
Ordinary programs cannot write to the kernel's record, so it is the better witness of what the process really is.
In the Process's Own Memory
The PEB is ordinary memory in the process, so code running there can rewrite it and fool any tool that reads only the PEB.

The Map

The process window on the topic page shows a process as a row with seven tabs. Each card below names a tab, who keeps what it reads and the page that explains it.

Each tab of the process window, who keeps what it reads, and its page

Kept by the kernelIn the process's own memory, which code in it can change

Read a Process in Order

The pages in this section follow a learner's order. An investigation runs in another order, the one in which a disguise usually gives itself away.

Start with the process list, and check its name, parent, account, path and command line against the process's own page. Then read its threads and memory, then its DLLs and handles, then its connections and token.

A process whose list columns are right but whose threads start in memory no file backs is the case the inside view exists for.

The Kernel and the Process Disagree

When the two records disagree, believe the kernel. Code in the process can write to the PEB, and Microsoft calls the PEB an internal structure whose layout may change.

The kernel writes a path in its own form, starting \Device\HarddiskVolume3 where the PEB writes C:, so set that part aside before comparing. Here the kernel's record shows a copy in C:\Users\Public, while the PEB claims the Windows copy.

One process on ws-017, dana's workstation, on 22 Oct 2026 (illustrative), as each side records it

The Kernel's Record

Image name
svchost.exe
Image path
\Device\HarddiskVolume3\Users\Public\svchost.exe

The Process's Own Copy

Image name
svchost.exe
Image path
C:\Windows\System32\svchost.exe
  • Image nameAgrees
  • Image pathDisagrees: the PEB names the Windows copy

What Normal Looks Like

On a healthy machine this part looks like this.

  • The kernel's record and the PEB name the same program file.
  • The command line in the PEB matches the one recorded when the process started.
  • Its code runs from the program and DLL files it loaded, and every thread starts there.
  • It runs as the account its job needs, at the integrity level that account gets.

Why It Matters

A process can pass every column of a process list and still hold code that is not its own. Knowing which part each tool reads, and who can change it, tells you where to look next.

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

Normal

A clean Windows 11 install

spoolsv.exe, the print spooler, on a clean install, with every column as Windows starts it.
NamePIDParentPath
spoolsv.exePID 808services.exeC:\Windows\System32\spoolsv.exe
See It in the Window

Suspicious

ws-042,

The genuine print spooler on ws-042 at 10:08 on 12 Oct 2026. It matches the clean row, yet code that is not its own runs inside it.
NamePIDParentPath
spoolsv.exePID 3268services.exeC:\Windows\System32\spoolsv.exe
PathThe genuine path, as on the clean side: the list cannot show this, so open its Threads and Memory tabs. Remote Thread Injection
See It in the Window

What a Malicious Example Shows

Each card is what malicious use of this part looks like, and where it shows.

  • The kernel's record names one program file and the PEB another.Where it shows: windows.malware.pebmasquerade sets the two paths side by side in a memory image.
  • The command line in the PEB differs from the one recorded when the process started.Where it shows: windows.cmdline in a memory image, set against Sysmon event 1 or event 4688 in the Security log.

Live and in Memory

A live tool asks Windows about a process while it runs. Volatility 3 reads the same records from a memory image, a saved copy of the machine's memory, where code that hides from a live tool often still shows.

On a Running Machine

  1. The process, still running
  2. Windows answers
  3. A live tool shows it

A live tool such as Process Explorer asks Windows about the process while it runs. It is quick, but code that is still running can hide from it.

In a Memory Image

  1. The machine's memory
  2. Saved to a file
  3. Read later by Volatility 3

A memory image is a copy of the machine's memory saved at one moment. Nothing on the machine can change the copy, so code that hides from live tools often still shows, but it shows one moment only.

  • Which processes are running, and do the kernel's own lists agree?

    On a Running Machine

    • Process Explorer (documentation, opens in a new tab)Live Machine A free Microsoft tool that works like a detailed Task Manager. It shows each process under the one that started it, with its DLLs and handles. Each process with its parent, owning account, path and command line.
    • Windows.System.Pslist (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. Pslist means process list. The same across many machines, with path, command line, user and start time.

    In a Memory Image

  • Does the process's own copy agree with the kernel's record?

    On a Running Machine

    In a Memory Image

  • What does it hold open, and who does it run as?

    On a Running Machine

    In a Memory Image

To take it offline, read Dumping a Process and Memory

What It Misses

Every way of looking has gaps, so cover these from another source.

  • A live tool sees only what the running system reports now. For anything that ended before you looked, read creation records or a memory image.
  • A memory image holds only the pages that were in RAM, so a part you cannot read is not proof it was empty.

False Positives

These look odd but are normal, so rule them out before you act.

  • Paths differ in form between tools. The kernel writes device paths without a drive letter, so normalise both before calling two paths different.
  • Some programs change their own command line after starting, so a PEB copy that differs from the creation record is a lead to explain, not a verdict.

Checks That Use It

These checks read this part as one of their steps.

Sources

MITRE ATT&CK is a free public catalogue of the techniques attackers use. Each technique has an ID, such as T1055 for Process Injection, so defenders can name the same behaviour the same way. Reading this part helps find these techniques.