Could someone explain to me — it's not <i>actually</i> crashing on its first instruction, I take it?<p>Why does it appear to be crashing on the first instruction?<p>Did the malware mess with the main thread's code, so that the first instruction of the main thread was the invalid write instruction?<p>But then the malware thread must have run first somehow, no? (since that thread is in the same process)<p>I think I followed the article generally, but I don't understand what actual sequence of events might have taken place that resulted in this report of "crashed on first instruction."