At an agency workstation, a detection record shows a script host making an unusual API call that allocates memory inside a second process. What kind of artifact is that record describing?
Select an answer to reveal the explanation.
Short Explanation
Think of a stagehand reaching into another actor's props. You are looking at a system API call that allocated memory inside a second process. The trap is relabeling that call as a web category, a byte count, or a certificate serial.
Full Explanation
Allocating memory inside a different process is a host action performed through a system API. That cross-process allocation is a common step in injection, so the detection artifact is the API call itself, not a network summary. "A system API call tied to allocating memory inside another running process" names the artifact. "A URL category assigned by the web filter for an ordinary browsing session" is a web-proxy label and does not describe a process calling into another process. "A NetFlow byte count summarizing how much data that conversation transferred" is a volume total for a flow, with no API name. "A certificate serial number taken from the server certificate seen on the wire" identifies a certificate, not a memory operation. Exam caveat: debuggers and some admin tools can call similar APIs, so the record type is still an API call and the context decides whether it is hostile. Operational check: note the calling process, the target process, and the API name from the event before you compare the call with normal admin activity. Record that trio in the case notes.