WriteProcessMemory Monitor

In the eventuality that your computer is infected with a rootkit, then chances are that your first instinct is to open the Task Manager and start analyzing the active processes. While your approach is legit, you should keep in mind that sneaky malware such as rootkits can usually mask themselves using legitimate Windows system processes.

As the name suggests, WriteProcessMemory Monitor is a lightweight program that enables you to be updated about the processes that tend to write over other system tasks' virtual space.

What makes the program stand out is the display system of the processes. Every event is neatly presented in a clean panel along with the data and time, name, target, locations, buffer, buffer length and address. The data can be useful for determining the dangers posed by the application via reverse engineering.

Without denying that Task Manager gets better and better with each version, for the time being it still lacks a certain flexibility that would help you differentiate between legitimate and hidden processes.

It is necessary to mention that the program can be minimized to System Tray and continue keeping track of the processes that are writing over other tasks memory as long as you have the computer open. In case you shut down your computer and you missed something, rest assured that you can check the logs for any suspicious activity.

Speaking of logs, it is necessary to mention that the app's only setting is to establish the location where the reports are saved. Moreover, you can save the events' summaries as a plain text file.

All in all,  WriteProcessMemory Monitor keeps tracks of both the caller process as well as the targeted tasks, so it can prove useful in confirming or dismissing the idea of a rootkit or other types of hidden malware infection.